# LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.11 - Authenticated (LP Instructor+) Missing Authorization to Quiz Answer Key and Course Curriculum Disclosure via Editor Callbacks

- **ID:** WPSEC-2026-1603
- **Plugin:** LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (`learnpress`), https://wordpress.org/plugins/learnpress/
- **Affected versions:** from 4.2.8.6 before 4.4.12
- **Fixed in:** 4.4.12 (Update to 4.4.12 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/learnpress
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1603/

## Description

The LearnPress plugin for WordPress is vulnerable to unauthorized access of data in versions 4.2.8.6 up to, and including, 4.4.11, due to the question editor, quiz editor and course curriculum editor callbacks of the load_content_via_ajax handler lacking an edit permission check on the requested question, quiz or course and verifying at most a generic capability to create items. This makes it possible for authenticated attackers, with LP Instructor-level access and above, to view the editor content of other instructors' questions, quizzes and course curricula, including which answers are marked correct.

## References

- https://wpsec.com/vuln/WPSEC-2026-1603/
- https://plugins.svn.wordpress.org/learnpress/tags/4.4.12/
- https://wordpress.org/plugins/learnpress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1603/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.