Learnpress Wordpress Lms Plugin For Create And Sell Online Courses
CVE-2026-3225
|
EUVD-2026-14610
MEDIUM
GHSA-fmxp-8cv8-5w59
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 4.3 (with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) indicates low confidentiality impact but direct integrity impact, achieved through a network vector with low attack complexity and only low privilege requirements. The vulnerability is particularly notable because it affects WordPress Subscriber-level users, the lowest privilege tier beyond unauthenticated access, and requires no user interaction. The integrity impact is focused on quiz content corruption rather than data exfiltration. While no EPSS score or active KEV listing is provided in the intelligence data, the practical exploitability is high due to the ease of obtaining Subscriber credentials on WordPress sites and the straightforward AJAX call mechanics required. Real-world risk is moderate-to-high for educational institutions using LearnPress, as threat actors or disgruntled users could systematically corrupt quiz questions across the platform. The availability of public code references in the WordPress plugin repository allows security researchers and adversaries alike to understand the vulnerability mechanics. |
| Exploit ScenarioDerived | A disgruntled student or low-privilege account holder on a WordPress site with the LearnPress plugin logs in as a Subscriber. They craft a direct AJAX request to the delete_question_answer() endpoint, targeting quiz questions from courses they are not enrolled in or authorized to modify. Since the AbstractAjax dispatcher validates only the nonce without checking user capabilities, and the EditQuestionAjax handler lacks authorization checks, the AJAX request succeeds and deletes critical answer options from quiz questions. The attacker repeats this process across multiple quizzes to corrupt course assessments, impacting the integrity of the learning platform without triggering any audit logs or permissions-based rejection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
The LearnPress WordPress LMS Plugin contains a missing capability check vulnerability in the delete_question_answer() function that allows authenticated attackers with Subscriber-level privileges to delete quiz answer options without authorization. Affected versions include 4.3.2.8 and earlier; the vulnerability was patched in version 4.3.3. While the CVSS score is moderate (4.3), the attack requires only low-privilege authentication and no user interaction, making it practical for any authenticated site user to exploit.
RemediationAI
Upgrade the LearnPress plugin immediately to version 4.3.3 or later, which includes the authorization check fix. Site administrators should navigate to WordPress Plugins dashboard and apply the available update, or use WP-CLI with 'wp plugin update learnpress'. Until patching is possible in an active learning environment, implement temporary compensating controls by restricting Subscriber role access to quiz editing features at the plugin settings level, limiting which user roles can create or modify quiz content. Additionally, audit current quiz questions and answer options to identify any suspicious deletions or corrupted quiz content. Organizations managing critical educational content should also consider implementing a database backup and recovery procedure to restore compromised quiz data. For detailed patch information, consult the official WordPress plugin repository at https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.3.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the LearnPress WordPress LMS Plugin (CPE: cpe:2.3:a:thimpress:learnpress_–_wordpress_lms_plugin_for_create_and_sell_online_courses:*:*:*:*:*:*:*:*), specifically within the Ajax request handling architecture. The root cause is classified as CWE-862 (Missing Authorization). The technical flow involves three layers: (1) the AbstractAjax::catch_lp_ajax() dispatcher which validates a wp_rest nonce but omits current_user_can() capability checks, (2) the EditQuestionAjax class's delete_question_answer() function which calls the delete method without verifying user permissions, and (3) the QuestionAnswerModel::delete() method which only validates minimum answer count thresholds but does not enforce WordPress capability checks. This represents a complete absence of authorization validation across the entire request pipeline for quiz answer deletion operations.
Know when Learnpress Wordpress Lms Plugin For Create And Sell Online Courses gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answers due to a missing capability check in the delete_question_answer() function of the EditQuestionAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check, and the QuestionAnswerModel::delete() method only validates minimum answer counts without checking user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete answer options from any quiz question on the site.
Executive ViewAI
Organizations using all should be aware of moderate risk from CVE-2026-3225, a missing authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated PHP object injection in the LearnPress WordPress LMS plugin through version 4.4.10 allows attackers to s
Unauthenticated data deletion in LearnPress WordPress LMS plugin (versions ≤4.3.2.8) allows remote attackers to delete a
Sensitive information exposure in the LearnPress LMS plugin for WordPress (versions up to and including 4.4.1) lets unau
Unauthenticated attackers can read and download course-material files - including uploaded file paths and external URLs
Stored cross-site scripting in the LearnPress WordPress LMS plugin (all versions up to and including 4.4.10) lets attack
Course enrollment data exposure in LearnPress WordPress LMS plugin (all versions through 4.3.9.1) enables authenticated
An authorization bypass in the LearnPress WordPress LMS plugin (all versions through 4.4.10) lets any authenticated user
Stored cross-site scripting in LearnPress - WordPress LMS Plugin versions through 4.3.9.1 allows authenticated contribut
Stored Cross-Site Scripting in the LearnPress WordPress LMS plugin (versions up to and including 4.4.0) allows authentic
Stored Cross-Site Scripting in LearnPress WordPress LMS Plugin up to version 4.3.3 allows authenticated contributors to
LearnPress WordPress LMS plugin versions through 4.4.7 reflect unsanitized input from the 'orderby' parameter into the D
Sensitive information exposure in LearnPress WordPress LMS Plugin (all versions through 4.3.6) allows unauthenticated re
Exploit-DB