CVE-2026-10630 in WP Courses LMS Plugin
Summary
by MITRE • 08/25/2026
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to read any other user's quiz answers and scores by enumerating the incrementing resultID value via the wpcq_get_quiz_result AJAX action. The only access control on this endpoint is a nonce check (wpc_nonce) that is exposed to every logged-in user on the frontend, providing no meaningful authorization barrier.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in WP Courses LMS versions up to 3.2.29 represents a critical failure in access control mechanisms, specifically classified as an Insecure Direct Object Reference or IDOR under CWE-639. This flaw resides within the plugin's handling of quiz result data through the wpcq_get_quiz_result AJAX action endpoint. The core technical issue stems from the application's reliance on the 'resultID' parameter to retrieve specific user quiz outcomes without implementing any server-side verification that ensures the requesting user is authorized to view that particular record. In a secure implementation, the system must validate not only that the requester is authenticated but also that they possess ownership or explicit permission for the requested resource ID. Instead, this plugin accepts an incrementing integer value provided by the client and directly maps it to database records without cross-referencing against user-specific constraints.
The operational impact of this vulnerability allows any authenticated attacker with custom-level access or higher privileges to enumerate quiz results belonging to other users on the same WordPress installation. By systematically iterating through sequential resultID values, an adversary can extract sensitive information including individual student answers and final scores. This capability effectively bypasses intended privacy boundaries within the learning management system, leading to a significant breach of confidentiality for students whose academic performance data is exposed. The severity of this exposure is compounded by the fact that quiz results often contain personally identifiable information or intellectual property related to course assessments, making them valuable targets for malicious actors seeking competitive advantage or reputational damage against educational institutions.
The root cause of this authorization bypass lies in the insufficient access control logic implemented at the endpoint level. The only security measure present is a nonce check using wpc_nonce, which serves primarily to prevent Cross-Site Request Forgery attacks by ensuring the request originates from a legitimate session on the frontend interface. However, nonces do not provide any form of object-level authorization; they merely validate that the user is logged in and has initiated the action within an expected timeframe. Consequently, once a valid nonce is obtained through standard page loads accessible to all authenticated users, the attacker can manipulate the resultID parameter freely without triggering additional permission checks. This design flaw aligns with ATT&CK technique T1078, Valid Accounts, as it exploits legitimate credentials to access unauthorized data resources within the application environment.
To mitigate this vulnerability, immediate action is required by upgrading the WP Courses LMS plugin to a version where this issue has been patched, ensuring that developers have implemented proper ownership verification logic for all AJAX endpoints handling user-specific data. In addition to updating software, administrators should enforce strict role-based access controls and consider implementing additional server-side validation layers that verify the relationship between the current session's user ID and the requested resource ID before returning any sensitive information. Regular security audits of custom WordPress plugins are essential to identify similar patterns where direct object references lack adequate authorization checks, thereby maintaining the integrity and confidentiality of educational data within the platform ecosystem.