The vulnerability identified as CVE-2026-25002 affects the LearnPress – Sepay Payment plugin by ThimPress. It enables an attacker to bypass authentication mechanisms by exploiting an alternate path or channel within the plugin, allowing unauthorized access or actions. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity. The affected versions include all releases up to 4.0.0. No patch or vendor advisory details are currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability allows an attacker to bypass authentication controls, leading to unauthorized actions that compromise the integrity of the affected system. There is no impact on confidentiality or availability reported. This could enable attackers to perform actions reserved for authenticated users without proper authorization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected plugin or disabling the Sepay Payment integration if feasible to reduce exposure.