CVE-2026-78125: 
WordPress vulnerability analysis and mitigation

CVE-2026-78125 is an unauthenticated order status disclosure vulnerability in the LearnPress – Sepay Payment WordPress plugin. The plugin fails to perform any authorization check on one of its REST endpoints in all versions up to and including 4.0.2, allowing unauthenticated attackers to enumerate order identifiers and retrieve the payment status of arbitrary orders. It was publicly disclosed on August 25, 2026, and published to the NVD on August 27, 2026. The vulnerability carries a CVSS score of 5.3 (Medium) and is classified under CWE-200 (Information Exposure) (WPScan, GitHub Advisory).

The root cause is a missing authorization check (CWE-200 / OWASP A3: Sensitive Data Exposure) on a REST API endpoint exposed by the LearnPress Sepay Payment plugin. An unauthenticated attacker can send sequential or enumerated HTTP requests to the unprotected REST endpoint, supplying incrementing order identifiers to retrieve payment status information for arbitrary orders without any authentication or capability check. No authentication or special privileges are required, making the attack surface broad for any internet-facing WordPress site running the affected plugin versions (< 4.0.3). The vulnerability was discovered and reported by researcher Shikhali Jamalzade; a proof-of-concept is scheduled for public release on September 8, 2026, to allow time for users to update (WPScan).

Successful exploitation allows unauthenticated remote attackers to enumerate order identifiers and disclose the payment status of arbitrary orders processed through the LearnPress Sepay Payment plugin. This constitutes a confidentiality breach that may expose sensitive transactional metadata — such as whether a payment was completed, pending, or failed — for any order in the system. While the vulnerability does not enable code execution or direct data modification, the exposed order status information could be leveraged for fraud, targeted social engineering, or business intelligence gathering against affected e-learning platforms (WPScan, GitHub Advisory).

There is currently no public proof-of-concept exploit available, though WPScan has indicated a PoC will be released on September 8, 2026. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is reported as 0.0, reflecting the current low probability of exploitation. The attack requires no authentication and is exploitable over the network, which lowers the barrier for opportunistic attackers once a PoC is published (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the LearnPress Sepay Payment plugin (versions < 4.0.3) using tools like WPScan, Shodan, or by inspecting plugin directories exposed via the target site.
2. Identify the vulnerable REST endpoint: Locate the unprotected REST API endpoint registered by the plugin (specific endpoint path not yet publicly disclosed pending PoC release on September 8, 2026).
3. Enumerate order identifiers: Send unauthenticated HTTP GET requests to the REST endpoint with incrementing or guessed order ID values (e.g., ?order_id=1, ?order_id=2, etc.).
4. Harvest payment status data: Parse the API responses to collect payment status information (e.g., completed, pending, failed) for each valid order identifier returned by the server (WPScan).

• Network: Unusual volume of unauthenticated HTTP GET requests to WordPress REST API endpoints associated with the LearnPress Sepay Payment plugin, particularly with sequentially incrementing or enumerated order ID parameters.
• Logs: WordPress or web server access logs showing repeated requests to /wp-json/ REST API paths from a single IP or small range of IPs, with varying order identifier values and no authentication headers.
• Logs: HTTP 200 responses to REST endpoint requests from unauthenticated sources at an abnormally high rate, suggesting automated enumeration activity.

The primary remediation is to update the LearnPress Sepay Payment WordPress plugin to version 4.0.3 or later, which introduces the missing authorization check on the affected REST endpoint (WPScan). As a temporary workaround, administrators can restrict access to WordPress REST API endpoints via web server configuration (e.g., blocking or rate-limiting requests to /wp-json/ paths) or use a WordPress security plugin to enforce authentication on REST endpoints. Monitoring for suspicious enumeration patterns against order-related REST endpoints is also recommended until the patch is applied.

The vulnerability was discovered and responsibly disclosed by security researcher Shikhali Jamalzade (Twitter: @0xAlisAlive), who submitted it through WPScan's coordinated disclosure process. WPScan has verified the vulnerability and is withholding the full proof-of-concept until September 8, 2026, to provide a remediation window for site administrators (WPScan). No significant broader media coverage or notable community reactions have been observed at this time.