This vulnerability in ThimPress LearnPress (<= 4.2.9.4) is caused by missing authorization checks, which leads to incorrect access control enforcement. An attacker can exploit this issue remotely without authentication or user interaction to gain unauthorized access to sensitive information, impacting confidentiality. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact. No patch or official remediation guidance has been provided yet.

The vulnerability allows an unauthenticated remote attacker to bypass access controls and access sensitive information, resulting in a high confidentiality impact. There is no impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications and consider restricting access to LearnPress installations where feasible to reduce exposure.