Security readout for executives and security teams
Plain-English summary
CVE-2026-1787 affects the LearnPress Export Import WordPress extension. An unauthenticated attacker may delete courses migrated from Tutor LMS if Tutor LMS is also installed and active. The business impact is targeted data loss rather than server takeover. Urgency is moderate, especially for training, education, or commerce sites relying on migrated course content.
Executive priority
Treat as a moderate-priority data integrity issue. Prioritize affected education or training sites where course deletion would disrupt revenue, learning delivery, or customer trust. This is less urgent than remote code execution, but remediation should not wait on sites with active Tutor LMS migrations.
Technical view
The issue is a missing capability check, CWE-862, in the delete_migrated_data function in LearnPress Export Import up to and including 4.1.0. Wordfence rates it CVSS 4.8 with network access, no privileges, no user interaction, high attack complexity, low integrity impact, and low availability impact.
Likely exposure
Exposure appears limited to WordPress sites running LearnPress Export Import <= 4.1.0 with Tutor LMS installed and activated, and with courses migrated from Tutor LMS. Sites without Tutor LMS active or without migrated Tutor LMS course data are less likely to be practically affected based on the CVE description.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation is described as unauthenticated but high complexity, and it targets deletion of migrated course data rather than confidentiality or code execution.
Researcher notes
Evidence points to an unauthenticated missing authorization check in TutorMigrationController.php. The CVE states exploitation requires Tutor LMS to be installed and activated. The referenced WordPress Trac changeset is relevant for remediation review, but the provided bundle does not name a fixed release version.
Mitigation direction
- Identify sites running LearnPress Export Import and Tutor LMS together.
- Upgrade LearnPress Export Import beyond 4.1.0 if a vendor-fixed release is available.
- Review the WordPress plugin changeset and vendor guidance before deploying changes.
- Back up course data before updating or changing migration components.
- Restrict unnecessary plugin exposure by disabling unused migration tooling.
Validation and detection
- Inventory WordPress sites for LearnPress Export Import versions <= 4.1.0.
- Check whether Tutor LMS is installed and activated.
- Confirm whether Tutor LMS course data was migrated into LearnPress.
- Review logs for unexpected migrated course deletion events.
- Verify the installed plugin includes the authorization changes from the referenced changeset.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1787 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L2.22.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.8MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7bde915d-092a-452b-a0e0-ce5c2ce203dc?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.0/inc/Migration/Controllers/TutorMigrationController.php#L55CVE reference
- https://plugins.trac.wordpress.org/changeset/3458589/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.