LearnPress CVE-2026-82024

Exploitation requires the attacker to possess an authenticated WordPress account with the LearnPress Instructor role on the target site running a version of the plugin prior to 4.4.6. No elevated WordPress administrator privileges are needed to inject the payload - the Instructor role alone is sufficient to submit quiz answers. A victim (student, instructor, or administrator) must subsequently navigate to and view the quiz page containing the injected answer title, which is the UI:P condition in the CVSS 4.0 vector. Exploitation is limited by the requirement to obtain an Instructor-role account; sites that restrict this role to fully trusted internal staff face substantially reduced realistic risk compared to open-enrollment platforms where external users can self-register as Instructors.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/SC:L/SI:L) yields a 5.1 Medium score that accurately describes the mechanical prerequisites but understates the practical impact on WordPress-based LMS deployments. Requiring the Instructor role (PR:L) limits the attacker pool to authenticated users with a specific platform role, but many LMS operators grant Instructor accounts to external contractors, course authors, or students who complete a registration workflow - making the population of potential attackers non-trivial. The cross-user execution (SC:L/SI:L in 4.0; S:C in 3.1 terms) is the critical amplifier: when an administrator views the poisoned quiz, stored XSS payloads in WordPress context can create rogue admin accounts, install backdoors, or exfiltrate authentication cookies, effectively escalating to full site compromise. Even a mid-sized municipal IT team in gliwice running a staff training portal on LearnPress should treat this as a priority patch rather than a routine medium-severity backlog item, especially where Instructors are not all fully vetted staff. No KEV listing and no confirmed public POC exist at time of analysis, so exploitation remains opportunistic rather than systematic.

An attacker who holds or acquires a LearnPress Instructor account submits a quiz question with a JavaScript payload - such as a cookie-exfiltrating script - embedded in the answer title field. When a site administrator later opens the quiz for review or grading, the payload fires in the admin's browser session, enabling the attacker to steal the admin's authentication cookie and subsequently take over the WordPress site with full administrative privileges.