CVE-2026-7565

Vulnerability

The LearnPress – Backup & Migration Tool plugin for WordPress, in all versions up to and including 4.1.4, suffers from an Arbitrary File Read vulnerability. This vulnerability is triggered through the import-user-file parameter, allowing directory traversal.

Exploitation

An authenticated attacker with administrator-level access or higher can exploit this vulnerability. The attacker needs to send a crafted request to the plugin, specifically manipulating the import-user-file parameter to include a path traversal sequence, thereby accessing arbitrary files on the server.

Impact

Successful exploitation allows an attacker to read the contents of arbitrary files on the server. This can lead to the disclosure of sensitive information, such as configuration files, credentials, or other private data, depending on the files accessible by the web server process.

Mitigation

Versions of the LearnPress – Backup & Migration Tool plugin up to and including 4.1.4 are affected. The vendor has released version 4.1.5, which addresses this vulnerability. Users are advised to update to version 4.1.5 or later. The update was released on 2026-05-25 [1].