CVE-2026-7565 is a path traversal vulnerability (CWE-22) in the LearnPress – Backup & Migration Tool WordPress plugin. It affects all versions from initial release up to 4.1.4 inclusive. The vulnerability arises from improper limitation of a pathname to a restricted directory via the 'import-user-file' parameter, enabling authenticated administrators to read arbitrary files on the server. This can lead to disclosure of sensitive information. The CVSS v3.1 base score is 4.9 (medium severity), with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality impact. No official fix or patch has been documented as of the published date.

Authenticated users with administrator-level access can exploit this vulnerability to read arbitrary files on the server hosting the WordPress plugin. This can result in disclosure of sensitive information, potentially compromising confidentiality. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for unusual file access patterns related to the 'import-user-file' parameter. Avoid using affected versions (>=0 <4.1.5) in production environments if possible.