Vulnerabilities / LearnPress – WordPress LMS Plugin for Create and Sell Online Courses / WPSEC-2026-1604
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.11 - Authenticated (Contributor+) Insecure Direct Object Reference to Question Answer Modification
Medium 4.3
CWE-639Fixed in 4.4.12
- ID
- WPSEC-2026-1604
- Plugin
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (learnpress)
- Affected
- from 4.2.9 before 4.4.12
- Remediation
- Update to 4.4.12 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-25
- Attack surface
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses on WPSec AttackSurface
- Fix released
- Published
Description
The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.2.9 up to, and including, 4.4.11, due to the question answer update capability check being made against a question ID supplied in the request rather than the question the answer belongs to, and being a generic post edit check that any post the user can edit satisfies. This makes it possible for authenticated attackers, with contributor-level access and above, to overwrite the text and correct-answer setting of answers belonging to any quiz question, or move those answers out of their question.
References
- https://wpsec.com/vuln/WPSEC-2026-1604/
- https://plugins.svn.wordpress.org/learnpress/tags/4.4.12/
- https://wordpress.org/plugins/learnpress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS