LearnPress < 4.3.7 – Unauthenticated Sensitive User Information Disclosure via REST API | CVE 2026-8383

Description

The plugin does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request

Proof of Concept

1. Install and activate LearnPress 4.3.6 on a clean WordPress site.

2. As an unauthenticated visitor, request:

```
curl 'https://example.com/wp-json/learnpress/v1/users?context=edit'
```

   The response includes each returned user's `roles` array (e.g. `["administrator"]`), full `capabilities` map (including `manage_options`, `install_plugins`, `unfiltered_html`, etc.), `extra_capabilities`, `locale`, and `registered_date`. WordPress core's `wp/v2/users` controller normally requires `current_user_can('edit_users')` before honouring this context.