CVE-2026-13765 thimpress CVE debrief

Who should care

Users of the LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress should be aware of this vulnerability and take immediate action to protect their sites. Affected operators, platforms, and security teams need to review the vulnerability and implement necessary mitigations. Vulnerability management and security teams should prioritize patching or mitigating this vulnerability to prevent potential data breaches.

Technical summary

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure. This vulnerability allows unauthenticated attackers to extract sensitive information, including correct-answer markers, full option lists, explanations, and question content for any quiz question on the site. The vulnerability exists in all versions up to, and including, 4.4.1 via the check_answer. Affected product deployments should be confirmed in managed environments and assigned an owner for follow-up.

Defensive priority

High

Recommended defensive actions

• Update the LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin to the latest version.
• Restrict access to sensitive information.
• Monitor for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-07-17T05:16:37.837Z and has not been modified since then. The NVD entry is currently being reviewed. Evidence suggests that the LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure. Further verification is needed to confirm the affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.