Security readout for executives and security teams
Plain-English summary
CVE-2026-3226 affects the LearnPress WordPress LMS plugin through version 4.3.2.8. A logged-in low-privilege user can trigger email notifications they should not control. Business impact is mainly trust and operational disruption: email flooding, misleading messages, and possible social engineering around instructor or admin decisions.
Executive priority
Address in the normal vulnerability remediation cycle, faster for public LMS sites with open registration. The issue is not a takeover bug, but it can damage trust in platform emails and create avoidable support or phishing-like incidents.
Technical view
The issue is missing authorization checks in all 10 SendEmailAjax functions. AbstractAjax::catch_lp_ajax() validates a wp_rest nonce but does not perform current_user_can() before dispatch. Because the nonce is available to authenticated users, Subscriber-level users can trigger notification flows. CVSS is 4.3, CWE-862.
Likely exposure
Exposure is limited to WordPress sites running LearnPress through 4.3.2.8, especially sites allowing public registration or many Subscriber-level accounts. Sites without authenticated untrusted users have lower practical risk.
Exploitation context
The CVE requires authenticated access but no user interaction. The provided sources do not show CISA KEV listing or active exploitation. Abuse would likely focus on email flooding, impersonation-like messaging, or social engineering rather than system takeover.
Researcher notes
Primary evidence points to nonce-only AJAX dispatch and missing capability checks. The WordPress changeset comparing 4.3.2.7 to 4.3.3 is relevant for remediation review. Evidence provided does not establish active exploitation or impact beyond unauthorized notification triggering.
Mitigation direction
- Upgrade LearnPress to a version newer than 4.3.2.8, such as 4.3.3 or later if available.
- If immediate upgrade is unavailable, restrict untrusted user registration and low-privilege account access.
- Monitor outbound WordPress/LearnPress email volume for unusual notification spikes.
- Review vendor guidance and changelog for the confirmed fixed release.
Validation and detection
- Inventory WordPress sites using the LearnPress plugin.
- Check the installed LearnPress version against vulnerable versions through 4.3.2.8.
- Review whether public registration or Subscriber-level access is enabled.
- Inspect logs for unusual LearnPress notification activity from authenticated low-privilege users.
- Confirm upgraded code includes added authorization checks in SendEmailAjax handlers.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-3226 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/520018db-d33b-4f2c-aaa5-611de792e11f?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.7/inc/class-lp-assets.php#L123CVE reference
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.7/inc/Ajax/SendEmailAjax.php#L40CVE reference
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.7/inc/Ajax/AbstractAjax.php#L17CVE reference
- https://plugins.trac.wordpress.org/changeset?old_path=/learnpress/tags/4.3.2.7/inc/Ajax/SendEmailAjax.php&new_path=/learnpress/tags/4.3.3/inc/Ajax/SendEmailAjax.phpCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.