CVE-2026-86447

MediumCVSS 5.3/10Last modified Sep 17, 2026

Description

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email addresses through the same handler's search filter.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Sep 16, 2026
Last modified
Sep 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-864483.7The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously genCVE-2026-864495.3The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in oCVE-2026-864507.5Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal aCVE-2026-864514.3Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data(CVE-2026-864527.5Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input boundCVE-2026-86469.1IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTPCVE-2026-864609.8Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache SyncCVE-2026-864618.8The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5CVE-2026-864629.1Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing CVE-2026-864637.5Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck tCVE-2026-864649.9In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deploCVE-2026-864656.5Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-tea