Skip to content
Threat Feed
Subscribe

Tag

Information-Exposure

2 briefs RSS
high advisory

Sensitive Information Exposure in LearnPress WordPress Plugin (CVE-2026-13765)

An unauthenticated sensitive information exposure vulnerability (CVE-2026-13765) in the LearnPress - WordPress LMS Plugin for Create and Sell Online Courses, versions up to 4.4.1, allows attackers to extract quiz answers, options, explanations, and question content, including for paid courses.

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.1 wordpress plugin vulnerability information-exposure web
1r 2t 1c
high advisory

Grav API Plugin Vulnerability Exposes JWT Access Tokens via URL Parameter

The Grav API plugin (getgrav/grav-plugin-api) before version 1.0.0-rc.16 is vulnerable to sensitive information exposure, accepting JWT access tokens via the '?token=' URL query parameter, causing these tokens to be logged in web server access logs, browser history, and potentially leaked through Referer headers, proxy, or CDN logs, which allows an attacker to gain unauthorized API access, read configuration and user data, create new admin accounts, modify system settings, and delete pages.

Grav API plugin +1 vulnerability web api jwt information-exposure grav
1r 6t 1c