CVE-2026-13765
HIGH
CVSS 7.5
learnpress_wordpress_lms_plugin_for_create_and_sell_online_courses
Verified Advisory
Missing Authorization in the LearnPress WordPress LMS plugin (CVE-2026-13765)
Information Disclosure
WordPress
Authentication Bypass
Learnpress Wordpress Lms Plugin For Create And Sell Online Courses
CVE-2026-13765 is a Missing Authorization vulnerability in the LearnPress WordPress LMS plugin that allows unauthenticated attackers to access sensitive quiz data via the /lp/v1/users/check-answer and /start-quiz REST endpoints. Exploitation enables extraction of correct-answer markers, full option lists, explanations, and question content for any quiz question, including those in paid courses the attacker has not enrolled in.
Affected versions:
- <= 4.4.1
We recommend updating to: 4.4.2.
CVSS 7.5 · our assessment: this_week
Vendor advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/ee3bbf20-43fd-4977-b0ba-b81e7a3810d0?source=cve
Details: https://vuln.today/cve/CVE-2026-13765
Verified by vuln.today against published advisories.
Affected versions
- – <= 4.4.1
Fixed in: 4.4.2