# LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.11 - Authenticated (Contributor+) Insecure Direct Object Reference to Question Answer Modification

- **ID:** WPSEC-2026-1604
- **Plugin:** LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (`learnpress`), https://wordpress.org/plugins/learnpress/
- **Affected versions:** from 4.2.9 before 4.4.12
- **Fixed in:** 4.4.12 (Update to 4.4.12 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/learnpress
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1604/

## Description

The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.2.9 up to, and including, 4.4.11, due to the question answer update capability check being made against a question ID supplied in the request rather than the question the answer belongs to, and being a generic post edit check that any post the user can edit satisfies. This makes it possible for authenticated attackers, with contributor-level access and above, to overwrite the text and correct-answer setting of answers belonging to any quiz question, or move those answers out of their question.

## References

- https://wpsec.com/vuln/WPSEC-2026-1604/
- https://plugins.svn.wordpress.org/learnpress/tags/4.4.12/
- https://wordpress.org/plugins/learnpress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1604/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.