What is the CVSS score of CVE-2026-13765?

CVE-2026-13765 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of LearnPress are affected by CVE-2026-13765?

LearnPress LMS plugin (versions ≤4.4.1) allows unauthenticated attackers to retrieve quiz answers, explanations, and full question content for any course on affected WordPress sites, bypassing…

How to fix or mitigate CVE-2026-13765?

Within 24 hours: Inventory all WordPress sites running LearnPress ≤4.4.1; block the vulnerable check_answer REST API endpoint using a Web Application Firewall (WAF) rule that denies unauthenticated POST requests to /wp-json/learnpress/v1/check-answer. Within 7 days: Deploy compensating controls including IP whitelisting for quiz endpoints to instructor/admin networks, API rate limiting (max 5 check_answer calls per IP per minute), and comprehensive logging of quiz access attempts; review access logs for indicators of exploitation. Within 30 days: Apply vendor patch when released (monitor LearnPress security advisories); upgrade to patched version and validate WAF rules are disabled; evaluate alternative LMS platforms with authentication-first architecture.

LearnPress CVE-2026-13765

EUVD-2026-45137 HIGH

Missing Authorization (CWE-862)

2026-07-17 Wordfence

GHSA-c7j6-mr7m-857j

WordPress Authentication Bypass Information Disclosure Learnpress Wordpress Lms Plugin For Create And Sell Online Courses Wordpress Plugin Thimpress

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network REST endpoint with no user interaction (AV:N/AC:L/PR:N/UI:N); pure disclosure of quiz answer data gives C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 05:17 vuln.today

CVE Published

Jul 17, 2026 - 03:43 cve.org

HIGH 7.5

DescriptionCVE.org

The LearnPress - WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the check_answer. This makes it possible for unauthenticated attackers to extract the correct-answer markers, full option lists, explanations, and question content for any quiz question on the site - including questions belonging to paid courses the attacker is not enrolled in.

AnalysisAI

Sensitive information exposure in the LearnPress LMS plugin for WordPress (versions up to and including 4.4.1) lets unauthenticated attackers pull correct-answer markers, complete option lists, explanations, and full question content for any quiz on the site through the check_answer logic in its frontend REST API. This exposes graded assessment material for paid courses the attacker never enrolled in or paid for, defeating the plugin's course-access model. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the network-facing, no-authentication nature makes it trivially reproducible against affected sites.

Technical ContextAI

LearnPress is a learning-management system (LMS) plugin that exposes course, lesson, and quiz functionality through a WordPress REST API namespace. The vulnerable code lives in the frontend users controller (class-lp-rest-users-controller.php, around lines 54/80/181/434 in tag 4.4.1) and the no-required-enroll course handling (class-lp-course-no-required-enroll.php:145), where the check_answer path returns quiz question data without verifying that the requester is enrolled in, or authorized to view, the associated course. The root cause is CWE-862 (Missing Authorization): a server-side endpoint performs a sensitive read action but omits the enrollment/ownership check that should gate it. Affected product per CPE is cpe:2.3:a:thimpress:learnpress_-_wordpress_lms_plugin_for_create_and_sell_online_courses across all versions, meaning the authorization gap is in the plugin's core REST layer rather than an optional module.

RemediationAI

Upstream fix available (changeset 3603546 in the LearnPress WordPress.org repository, https://plugins.trac.wordpress.org/changeset?reponame=&old=3603546%40learnpress&new=3603546%40learnpress); a specific released patched version number above 4.4.1 is not independently confirmed from the provided data, so administrators should update LearnPress to the latest available release from the WordPress plugin repository and verify the version is greater than 4.4.1, then consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/ee3bbf20-43fd-4977-b0ba-b81e7a3810d0?source=cve) for the exact fixed version. If immediate patching is not possible, compensating controls include placing a WAF or Wordfence rule in front of the LearnPress frontend REST routes (the users-controller check_answer/answer endpoints) to require authentication or block unauthenticated access, which may break legitimate anonymous quiz preview features, and disabling the 'no required enrollment' course setting so that quiz content is only served to enrolled users, at the cost of removing open-preview access to course material.