CVE-2020-7916: be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered u

The LearnPress plugin for WordPress versions 3.2.6.5 and earlier has a privilege escalation vulnerability (CVE-2020-7916) where any registered user can assign themselves the teacher role without permission checks, allowing them to access restricted instructor data. The flaw exists in the be_teacher function within class-lp-admin-ajax.php, which can be exploited through a specific URL endpoint without additional verification.