The LearnPress WordPress plugin prior to version 4.4.4 fails to verify that a user is enrolled in a course before handling AI-assistant requests related to that course's lesson content. This flaw permits any authenticated user, such as a subscriber, to retrieve content from paid courses they have not enrolled in, resulting in unauthorized information disclosure classified under CWE-200 (Information Exposure). No CVSS score or detailed exploit information is provided, and no patch or official remediation guidance is currently available.

Unauthorized authenticated users can access paid course lesson content without enrollment, leading to exposure of potentially sensitive or proprietary educational materials. This compromises the confidentiality of paid content but does not indicate privilege escalation or remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to limit access to AI-assistant features or disable the AI-assistant functionality if feasible to prevent unauthorized content access.