CVE-2026-113353 in LearnPress Plugin
Summary
by MITRE • 10/20/2026
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in LearnPress versions prior to 4.4.10 represents a critical failure in access control mechanisms within the WordPress plugin ecosystem. This flaw specifically affects administrative endpoints associated with course editing, quiz management, and question modification via AJAX requests. The core issue stems from improper authorization checks during these operations, which allows authenticated users with instructor privileges to bypass intended restrictions on resource ownership. In secure systems, actions that modify specific resources must verify not only the user's authentication status but also their explicit permission to act upon that particular instance of data. Here, the system fails to validate whether the requesting instructor is the legitimate owner or has been granted administrative rights over the target course, quiz, or question object.
Technically, this vulnerability exploits a weakness in how nonces and identifiers are processed during AJAX calls. The lp-ajax action handler accepts parameters for editing courses, quizzes, and questions but does not sufficiently enforce ownership constraints before executing state-changing operations. An attacker who has obtained valid instructor credentials can manipulate the id parameter within these requests to target resources belonging to other instructors. By reusing a generic editor nonce associated with their own account against different object identifiers, the malicious actor effectively tricks the application into believing they are authorized to perform edits on foreign content. This bypasses standard WordPress capability checks that would normally restrict such actions based on user roles and resource ownership rules.
The operational impact of this vulnerability is significant for multi-instructor learning platforms where multiple educators manage distinct courses or assessments. An attacker can modify course structures, alter quiz answers which may compromise the integrity of educational content or examination results, and delete questions belonging to other instructors. This leads to data tampering, loss of intellectual property, and potential disruption of academic activities. Since LearnPress is widely used for creating online courses, such unauthorized modifications could affect student experiences by changing curriculum details or grading criteria without consent from the original course creators. The ability to trash content also poses a risk of permanent data loss if backups are not regularly maintained.
From a classification perspective, this issue aligns with CWE-284 Improper Access Control and CWE-352 Cross-Site Request Forgery due to the reliance on nonces that can be reused across different contexts without proper validation against specific resource ownership. In terms of MITRE ATT&CK framework techniques, it relates to T1078 Valid Accounts as the attacker uses legitimate credentials, combined with T1499 Endpoint Denial of Service if deletion is exploited extensively, and potentially T1530 Data from Cloud Storage Object or Database via unauthorized modification actions. These mappings highlight how a simple authorization flaw can facilitate broader security breaches in web applications.
Mitigation strategies should focus on immediate patching to version 4.4.10 or later where these access control checks have been reinforced. Administrators running older versions must restrict user roles carefully, ensuring that only trusted administrators have elevated privileges while instructors are limited strictly to their own content. Implementing additional server-side validation for resource ownership before processing AJAX requests is essential. Furthermore, organizations should enforce strict nonce generation practices tied uniquely to each action and object combination rather than allowing generic reuse across different entities. Regular security audits of custom plugins can help identify similar authorization gaps in other parts of the application stack.