Medium severity5.4NVD Advisory· Published Oct 20, 2026
CVE-2026-113353
CVE-2026-113353
Description
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
6- github.com/LearnPress/learnpress/commit/77087dcdc0e974e8d0844453b4071189fc2c70d2nvd
- learnpresslms.com/changelog/nvd
- plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.phpnvd
- plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/admin/editor/class-lp-admin-editor-course.phpnvd
- wordpress.org/plugins/learnpress/nvd
- www.vulncheck.com/advisories/learnpress-before-4.4.10-missing-authorization-via-legacy-editor-ajax-handlersnvd
News mentions
0No linked articles in our index yet.