CVE-2026-1787: 
WordPress vulnerability analysis and mitigation

CVE-2026-1787 is a missing authorization vulnerability in the LearnPress Export Import WordPress plugin (an extension for LearnPress) that allows unauthenticated attackers to delete migrated course data. All versions up to and including 4.1.0 are affected. The vulnerability was published on February 21, 2026, and carries a CVSS v3.1 base score of 4.8 (Medium) (Red Hat CVE).

The root cause is a missing capability check (CWE-862: Missing Authorization) on the delete_migrated_data function within the LearnPress Export Import plugin. Because no authentication or privilege verification is performed before executing the deletion logic, any unauthenticated network attacker can invoke this function directly. A prerequisite for exploitation is that the Tutor LMS plugin must also be installed and activated on the same WordPress site, as the function targets courses migrated from Tutor LMS (Red Hat CVE).

Successful exploitation results in unauthorized deletion of courses that have been migrated from Tutor LMS, causing a loss of data integrity and availability for affected course content. The confidentiality impact is none, while integrity and availability are both rated low. Although the scope is limited to migrated course data, loss of educational content could disrupt e-learning operations on affected WordPress sites (Red Hat CVE).

The vulnerability requires no authentication and no user interaction, but exploitation complexity is rated High due to the prerequisite that Tutor LMS must be installed and active. The EPSS score is approximately 0.031% (0.000310), indicating a low probability of widespread exploitation in the near term. No evidence of in-the-wild exploitation, active exploit kits, or threat actor attribution has been reported as of the available data (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running both the LearnPress Export Import plugin (≤4.1.0) and the Tutor LMS plugin using tools like WPScan or passive fingerprinting via HTTP response headers and plugin asset paths.
2. Confirm prerequisites: Verify that Tutor LMS is installed and activated, and that course migration from Tutor LMS has been performed (migrated courses are the deletion target).
3. Craft unauthenticated request: Send a direct HTTP POST or GET request to the WordPress AJAX endpoint (e.g., wp-admin/admin-ajax.php) invoking the delete_migrated_data action, without supplying any authentication credentials or nonce.
4. Trigger data deletion: The missing capability check allows the function to execute, deleting migrated course data from the database without authorization (Red Hat CVE).

• Network: Unexpected unauthenticated POST requests to wp-admin/admin-ajax.php with the action parameter set to delete_migrated_data from external or unknown IP addresses.
• Logs: WordPress access logs showing requests to the AJAX endpoint without a valid session cookie or nonce, particularly from non-administrative sources.
• Database: Sudden disappearance of course records previously migrated from Tutor LMS with no corresponding admin activity in WordPress audit logs.

Users should update the LearnPress Export Import plugin to a version beyond 4.1.0 that includes a proper capability check on the delete_migrated_data function. Until a patched version is available, site administrators can deactivate or remove the LearnPress Export Import plugin as a temporary workaround. Additionally, restricting access to wp-admin/admin-ajax.php via firewall rules or a web application firewall (WAF) for unauthenticated users can reduce exposure (Red Hat CVE).