CyberRota Analysis
AI-GeneratedThe LearnPress WordPress plugin prior to version 4.4.7 is vulnerable due to a lack of authentication and capability checks, enabling unauthenticated attackers to access sensitive order export files. This flaw allows attackers to retrieve customer names, purchase details, and email addresses, posing a significant data leakage risk. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential exploitation.
Original NVD Description
The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email addresses.