Vulnerability in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — CVE-2026-82023

What to do now

Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to 4.4.6 or later.

Affected versions

• Everything before 4.4.6

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path. Attackers can supply arbitrary question identifiers during answer insertion, bypassing instructor-boundary restrictions to persistently modify quiz content across courses they do not own.

This description is reproduced verbatim from the public vulnerability record.

• https://wordpress.org/plugins/learnpress/#developers
• https://www.vulncheck.com/advisories/learnpress-wordpress-plugin-broken-object-level-authorization-via-quiz-answer-insert

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.