What is GHSA-h6f4-qpxm-7cpq?

GHSA-h6f4-qpxm-7cpq is a security advisory published by GitHub Security Advisories with Medium severity. The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of...

Which CVE IDs does GHSA-h6f4-qpxm-7cpq cover?

GHSA-h6f4-qpxm-7cpq covers the following CVE IDs: CVE-2026-78125. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h6f4-qpxm-7cpq?

GHSA-h6f4-qpxm-7cpq has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-h6f4-qpxm-7cpqMediumCVSS 5.3

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of...

Vendor

GitHub Security Advisories

Published

August 27, 2026

Last Modified

August 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-78125 →

📋 Description

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-78125
https://wpscan.com/vulnerability/ffadc07d-b7b9-42a5-ab1a-35116019df17
https://github.com/advisories/GHSA-h6f4-qpxm-7cpq