LearnPress instructors can modify questions owned by other instructors
LearnPress before 4.4.6 does not verify question ownership when an Instructor adds a quiz answer. An Instructor can submit another instructor's question identifier and persistently modify quiz content outside their own courses.
- Component
- LearnPress
- Plugin slug
learnpress- Affected
- < 4.4.6
- Safe version
4.4.6- Published
- Sep 03, 2026
This CVE was published Sep 03, 2026 and is one of 81 known issues for this plugin.
Update, patch or deactivate.
Update to 4.4.6 or later and review quiz questions for unauthorized answers or other cross-course changes.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path. Attackers can supply arbitrary question identifiers during answer insertion, bypassing instructor-boundary restrictions to persistently modify quiz content across courses they do not own.
CVE / CNA vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X