Threat Entry Updated 2026-04-15

CVE-2026-1787 - Learnpress Import Export Plugin

The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'delete_migrated_data' function in all versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to delete course that have been migrated from Tutor LMS. The Tutor LMS plugin must be installed and activated in order to exploit the vulnerability.

PLUGIN Learnpress Import Export

CVE-2026-1787

MEDIUM CVSS 4.8 2026-02-21

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-19

CVE-2024-9609 - Learnpress Import Export Plugin

The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_import_form_server' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

PLUGIN Learnpress Import Export

CVE-2024-9609

MEDIUM CVSS 6.1 2024-11-15

Risk Score

Open Full Technical Breakdown