Live › vulnerability › CVE-2026-113353
Go to dashboardLearnPress before 4.4.10 lets an instructor reuse their own editor nonce with another object's id in the admin course, quiz and question editor AJAX actions. An authenticated instructor can change other instructors' courses, alter quiz answers and trash questions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running LearnPress before 4.4.10 that have instructor accounts able to use the course editor. The flaw needs a logged-in instructor; sites with only administrators or students as users are not exposed to this path.
No product ranges from the sources yet.
wp plugin get learnpress --field=version4.4.10 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.
This page as .md · .json · in your agent: get_signal("CVE-2026-113353")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.