What is the CVSS score of CVE-2026-4365?

CVE-2026-4365 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-4365?

LearnPress WordPress LMS plugin versions 4.3.2.8 and earlier contain a critical vulnerability allowing unauthenticated remote deletion of quiz answer data.

How to fix or mitigate CVE-2026-4365?

Within 24 hours: Identify all WordPress installations running LearnPress plugin ≤4.3.2.8 and document current versions. Within 7 days: Implement Web Application Firewall (WAF) rules to block REST API calls to wp-json endpoints containing 'delete_question_answer' or restrict access to quiz REST endpoints to authenticated users only. Within 30 days: Monitor vendor LearnPress repository for patch release to version ≥4.3.2.9; apply immediately upon availability. If critical course delivery, consider temporary plugin deactivation pending patch release.

WordPress CVE-2026-4365

EUVD-2026-22197 CRITICAL

Missing Authorization (CWE-862)

2026-04-14 Wordfence

GHSA-fcmf-hc7m-63gh

Authentication Bypass WordPress

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 02:08 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 02:00 euvd

EUVD-2026-22197

Analysis Generated

Apr 14, 2026 - 02:00 vuln.today

CVE Published

Apr 14, 2026 - 01:24 nvd

CRITICAL 9.1

DescriptionCVE.org

The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the delete_question_answer() function in all versions up to, and including, 4.3.2.8. The plugin exposes a wp_rest nonce in public frontend HTML (lpData) to unauthenticated visitors, and uses that nonce as the only security gate for the lp-load-ajax AJAX dispatcher. The delete_question_answer action has no capability or ownership check. This makes it possible for unauthenticated attackers to delete any quiz answer option by sending a crafted POST request with a publicly available nonce.

AnalysisAI

Unauthenticated data deletion in LearnPress WordPress LMS plugin (versions ≤4.3.2.8) allows remote attackers to delete arbitrary quiz answer options without authentication. The plugin exposes wp_rest nonces to unauthenticated visitors in public frontend HTML and uses this nonce as the sole security gate for its AJAX dispatcher, while the delete_question_answer() function lacks both capability and ownership verification. With CVSS 9.1 (Critical) scoring and network-exploitable attack vector requi

Technical ContextAI

This vulnerability affects the ThimPress LearnPress WordPress LMS plugin (CPE: thimpress:learnpress_-_wordpress_lms_plugin_for_create_and_sell_online_courses), specifically the AJAX handling architecture. The plugin implements a centralized AJAX dispatcher (lp-load-ajax) that relies on WordPress wp_rest nonces for request validation. However, it violates secure design principles by exposing these nonces in public JavaScript objects (lpData) rendered in frontend HTML accessible to all visitors. The root cause is CWE-862 (Missing Authorization), where the delete_question_answer() method in EditQuestionAjax.php performs destructive database operations without verifying the requester has appropriate WordPress capabilities (e.g., edit_posts, manage_options) or owns the targeted resource. WordPress nonces are intended as CSRF tokens for authenticated sessions, not access control mechanisms for unauthenticated contexts. The AbstractAjax.php base class and class-lp-assets.php asset handling further compound the issue by making nonces globally available, creating an authentication bypass pathway.

RemediationAI

Upgrade to LearnPress version 4.3.2.9 or later immediately, which is expected to implement proper capability checks in the delete_question_answer() function and restrict nonce exposure to authenticated contexts. Site administrators should verify the installed plugin version via WordPress Admin Dashboard → Plugins, then update through the standard WordPress update mechanism or download directly from the official WordPress Plugin Repository. Review plugin source at https://plugins.trac.wordpress.org/browser/learnpress/trunk/ to confirm security enhancements in AbstractAjax.php nonce validation and EditQuestionAjax.php authorization logic. As a temporary workaround if patching is delayed, implement Web Application Firewall (WAF) rules to block unauthenticated POST requests to admin-ajax.php endpoints containing action=lp-load-ajax parameter, though this may impact legitimate frontend functionality. Audit quiz answer data integrity by reviewing recent database changes to wp_learnpress_question_answers tables for unauthorized deletions. Monitor WordPress access logs for suspicious AJAX requests from unauthenticated IP addresses. Consider disabling the LearnPress plugin entirely until patched if quiz integrity is business-critical. Consult Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/021bd566-1663-46ba-a616-ab554b691cbb for vendor-specific guidance and IOC detection rules.