What is the CVSS score of CVE-2026-3225?

CVE-2026-3225 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-3225?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Learnpress Wordpress Lms Plugin For Create And Sell Online Courses CVE-2026-3225

Q: Which versions of Learnpress Wordpress Lms Plugin For Create And Sell Online Courses are affected by CVE-2026-3225?

Organizations using all should be aware of moderate risk from CVE-2026-3225, a missing authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level.

EUVD-2026-14610 MEDIUM

Missing Authorization (CWE-862)

2026-03-23 Wordfence

GHSA-fmxp-8cv8-5w59

WordPress Authentication Bypass Learnpress Wordpress Lms Plugin For Create And Sell Online Courses Wordpress Plugin Thimpress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 22:45 euvd

EUVD-2026-14610

Analysis Generated

Mar 23, 2026 - 22:45 vuln.today

CVE Published

Mar 23, 2026 - 22:25 nvd

MEDIUM 4.3

DescriptionCVE.org

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answers due to a missing capability check in the delete_question_answer() function of the EditQuestionAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check, and the QuestionAnswerModel::delete() method only validates minimum answer counts without checking user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete answer options from any quiz question on the site.

AnalysisAI

The LearnPress WordPress LMS Plugin contains a missing capability check vulnerability in the delete_question_answer() function that allows authenticated attackers with Subscriber-level privileges to delete quiz answer options without authorization. Affected versions include 4.3.2.8 and earlier; the vulnerability was patched in version 4.3.3. While the CVSS score is moderate (4.3), the attack requires only low-privilege authentication and no user interaction, making it practical for any authenticated site user to exploit.

Technical ContextAI

The vulnerability exists in the LearnPress WordPress LMS Plugin (CPE: cpe:2.3:a:thimpress:learnpress_–_wordpress_lms_plugin_for_create_and_sell_online_courses:*:*:*:*:*:*:*:*), specifically within the Ajax request handling architecture. The root cause is classified as CWE-862 (Missing Authorization). The technical flow involves three layers: (1) the AbstractAjax::catch_lp_ajax() dispatcher which validates a wp_rest nonce but omits current_user_can() capability checks, (2) the EditQuestionAjax class's delete_question_answer() function which calls the delete method without verifying user permissions, and (3) the QuestionAnswerModel::delete() method which only validates minimum answer count thresholds but does not enforce WordPress capability checks. This represents a complete absence of authorization validation across the entire request pipeline for quiz answer deletion operations.

RemediationAI

Upgrade the LearnPress plugin immediately to version 4.3.3 or later, which includes the authorization check fix. Site administrators should navigate to WordPress Plugins dashboard and apply the available update, or use WP-CLI with 'wp plugin update learnpress'. Until patching is possible in an active learning environment, implement temporary compensating controls by restricting Subscriber role access to quiz editing features at the plugin settings level, limiting which user roles can create or modify quiz content. Additionally, audit current quiz questions and answer options to identify any suspicious deletions or corrupted quiz content. Organizations managing critical educational content should also consider implementing a database backup and recovery procedure to restore compromised quiz data. For detailed patch information, consult the official WordPress plugin repository at https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.3.