CVE-2026-25002
Published: 25 March 2026
Summary
CVE-2026-25002 is a high-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-25002 is an Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288) in the ThimPress LearnPress – Sepay Payment WordPress plugin (learnpress-sepay-payment), which allows authentication abuse. This issue affects the plugin from unknown initial versions through version 4.0.0 inclusive. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) and was published on 2026-03-25.
Unauthenticated attackers can exploit this vulnerability remotely over the network, though it requires high attack complexity and no user interaction. Successful exploitation enables bypassing authentication controls via an alternate path or channel, achieving high confidentiality impact through unauthorized access to sensitive information and low integrity impact, with a changed scope.
The Patchstack advisory provides further details on this WordPress plugin vulnerability, including potential mitigation guidance, at https://patchstack.com/database/Wordpress/Plugin/learnpress-sepay-payment/vulnerability/wordpress-learnpress-sepay-payment-plugin-4-0-0-broken-authentication-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15610
Vulnerability details
Authentication Bypass Using an Alternate Path or Channel vulnerability in ThimPress LearnPress – Sepay Payment learnpress-sepay-payment allows Authentication Abuse.This issue affects LearnPress – Sepay Payment: from n/a through <= 4.0.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authentication bypass in public-facing WordPress plugin directly enables initial access via exploitation of a vulnerable public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-14 identifies and restricts specific actions permitted without identification or authentication, directly preventing exploitation of authentication bypass via alternate paths or channels.
AC-3 enforces approved authorizations for all logical access to the system, blocking unauthorized access even through vulnerable alternate paths in the plugin.
SI-2 requires timely identification, reporting, and remediation of flaws such as this plugin authentication bypass, via patching to version beyond 4.0.0.