CVE-2026-8502 is a missing authorization vulnerability (CWE-862) in the LearnPress WordPress LMS Plugin for Create and Sell Online Courses, affecting all versions up to 4.3.6. An unauthenticated attacker can exploit the 'return_type' parameter combined with 'c_status=all' to bypass post status restrictions and retrieve sensitive data including plaintext post_passwords of password-protected courses and full content, author, and name fields of unpublished draft, private, and pending courses. This occurs via an unrestricted SELECT * fallback query in the /wp-json/lp/v1/courses/archive-course REST API endpoint. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

The vulnerability allows disclosure of sensitive information such as plaintext passwords and unpublished course content to unauthenticated attackers. This exposure could lead to unauthorized access to protected course materials and leakage of confidential information about unpublished or private courses. There is no indication of integrity or availability impact.

No official patch or remediation is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected REST API endpoint if possible or implement additional access controls to prevent unauthenticated requests from retrieving sensitive course data.