Wp Courses Lms Online Courses Builder Elearning Courses Courses Solution Education Courses
Monthly
Quiz result data exposure in the WP Courses LMS WordPress plugin lets any authenticated user read other users' quiz answers and scores by enumerating sequential resultID integers via the wpcq_get_quiz_result AJAX action. All plugin versions through 3.2.29 are affected; the only access gate - a frontend-exposed WordPress nonce - functions as an anti-CSRF token, not an authorization check, and is freely available to every logged-in user, providing no meaningful barrier. No public exploit code and no CISA KEV listing exist at time of analysis, but the trivial exploitation path and privacy implications of exposed assessment data make this a near-term remediation priority for any platform hosting sensitive educational content.
Quiz result data exposure in the WP Courses LMS WordPress plugin lets any authenticated user read other users' quiz answers and scores by enumerating sequential resultID integers via the wpcq_get_quiz_result AJAX action. All plugin versions through 3.2.29 are affected; the only access gate - a frontend-exposed WordPress nonce - functions as an anti-CSRF token, not an authorization check, and is freely available to every logged-in user, providing no meaningful barrier. No public exploit code and no CISA KEV listing exist at time of analysis, but the trivial exploitation path and privacy implications of exposed assessment data make this a near-term remediation priority for any platform hosting sensitive educational content.