CVE-2026-8383 is a missing authorization vulnerability (CWE-862) in the LearnPress WordPress plugin prior to version 4.3.7. The vulnerability occurs because the REST endpoint handling the 'edit' context does not enforce the required 'edit_users' capability check. As a result, unauthenticated attackers can retrieve detailed user information including roles, capabilities, locale, and registration dates via crafted requests to this endpoint. This exposure of sensitive user data could aid attackers in further attacks or reconnaissance. No CVSS score or vendor advisory is available, and no patch or official remediation has been confirmed.

Unauthenticated attackers can access sensitive user information such as user roles, full capabilities, extra capabilities, locale, and registration date. This information disclosure could facilitate further targeted attacks or privilege escalation attempts. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected REST endpoints if possible or implement additional access controls at the web server or application firewall level to block unauthenticated requests targeting these endpoints.