LearnPress CVE-2026-113353

Requires an authenticated WordPress account holding the LearnPress instructor role on the target site (PR:L); anonymous visitors cannot exploit it. The vulnerable legacy editor AJAX actions (admin_course_editor, admin_quiz_editor, admin_question_editor) must be registered and reachable, which is the default on LearnPress installations before 4.4.10. The attacker reuses their own legitimately-issued generic editor nonce and simply supplies another object's id parameter, because the handlers verify the nonce but omit a per-object ownership/capability check. Meaningful impact is limited to sites with more than one instructor whose content can be targeted; a single-instructor site gains little. No victim user interaction is required (UI:N).

This is a medium-severity authorization flaw (CVSS 4.0 base 5.3) whose real-world priority is moderate, not urgent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires authenticated privileges (PR:L) - specifically an instructor account - and impact is limited to integrity and availability of content (VI:L/VA:L) with no confidentiality loss (VC:N) and no scope change. CWE-639 (IDOR / missing authorization) is consistent with the description. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; all three widely-used exploitation signals are absent rather than conflicting. The main factor raising practical risk is that a vendor patch exists and the root cause is publicly visible in the GitHub commit diff, which lowers the effort to reverse-engineer the issue. Net assessment: a real but contained bug - relevant chiefly to multi-instructor LearnPress deployments - that warrants timely patching but is not a high-urgency, mass-exploitation threat. EPSS is missing, so widespread-exploitation probability cannot be quantified from the input.

On a LearnPress site with multiple instructors, a logged-in instructor opens their own course editor to obtain a valid generic editor nonce, then replays that nonce in an lp-ajax request (admin_course_editor/admin_quiz_editor/admin_question_editor) while substituting another instructor's course, quiz, or question id. Because the handlers validate the nonce but never verify object ownership, the attacker can edit the victim's courses, alter quiz answer keys, or trash questions. No public exploit code is identified at time of analysis, though the fix commit publicly reveals the vulnerable handlers.