CVE-2026-75982 thimpress CVE debrief

Who should care

WordPress administrators and security teams, especially those with Editor-level access and above, should assess exposure and prioritize remediation. They should verify the integrity of WordPress options and plugins, monitor for suspicious activity related to the learnpress_create_page AJAX action, and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-75982 allows authenticated attackers with Editor-level access to update arbitrary WordPress options, potentially enabling actions such as flipping users_can_register to a truthy value or corrupting active_plugins.

• Potential unauthorized modification of WordPress options
• Possible elevation of privileges for authenticated attackers
• Risk of site-wide settings tampering
• Need for verification of LearnPress plugin version and WordPress option integrity

Technical summary

The LP_Admin_Ajax::create_page() handler only checks the edit_pages capability and a wp_rest nonce, then reads the field_name parameter from the request without restricting it to a learn_press_* allow-list before passing it as the option key to LP_Helper::create_page(), which calls update_option($key_option, $page_id). This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary WordPress options to a positive integer (a newly created page ID), enabling actions such as flipping users_can_register to a truthy value to open public registration, corrupting active_plugins to break the site, or otherwise tampering with site-wide settings normally reserved for site-wide

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the LearnPress plugin, especially those with Editor-level access and above.

Recommended defensive actions

• Assess exposure by checking if the LearnPress plugin version is 4.4.4 or earlier
• Prioritize remediation for WordPress installations with Editor-level access and above
• Verify the integrity of WordPress options and plugins
• Monitor for suspicious activity related to the learnpress_create_page AJAX action
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows authenticated attackers with Editor-level access to update arbitrary WordPress options, potentially enabling actions such as flipping users_can_register to a truthy value or corrupting active_plugins.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.