LearnPress Plugin CVE-2026-82023

Exploitation requires an account with the WordPress Instructor role on the target LearnPress installation - unauthenticated and student-role users cannot exploit this flaw. The target site must run LearnPress before version 4.4.6 with at least two instructors and existing quiz content. The attacker must identify or enumerate valid question IDs belonging to other instructors, which may require some reconnaissance within the platform. Limiting factors: (1) Instructor-role authentication (PR:L) is mandatory; (2) the attacker must discover valid foreign question IDs; (3) impact is confined to quiz answer content integrity with no code execution, credential disclosure, or service disruption.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) correctly captures that exploitation is network-reachable but requires low-privilege Instructor-role authentication with no user interaction. Impact is integrity-only (VI:L) - no confidentiality or availability consequences are claimed. Real-world risk is further constrained to multi-instructor LMS deployments where quiz content integrity is operationally meaningful; single-instructor or student-only sites are not practically affected. No KEV listing and no public exploit identified at time of analysis keep the exploitation probability low. The 'Authentication Bypass' tag in the input metadata is a mislabeling - this is an authorization bypass (BOLA/IDOR), not an authentication bypass, and should not be interpreted as indicating unauthenticated access.

An authenticated Instructor on a multi-instructor eLearning site intercepts the quiz answer insert API request in a browser proxy, identifies or enumerates a valid question ID belonging to another instructor's course, and replaces the question identifier in the payload with the foreign ID. The server inserts the attacker-supplied answers without verifying ownership, persistently corrupting quiz content in courses the attacker does not administer. No exploit code is required; the technique is accessible to any instructor with basic API awareness.