LearnPress – WordPress LMS Plugin, CVE-2026-82023
- CVE, Research URL
- Application
- Published on
- Sep 03, 2026
- Research Description
- LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path. Attackers can supply arbitrary question identifiers during answer insertion, bypassing instructor-boundary restrictions to persistently modify quiz content across courses they do not own.
- Affected versions
-
max 4.4.6.
- Status
-
vulnerable