{"id":"CVE-2026-113353","kind":"vulnerability","aliases":["CVE-2026-113353"],"related":[],"title":"LearnPress: instructors can edit other instructors' courses, quizzes and questions","description":"LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.","summary":"LearnPress before 4.4.10 lets an instructor reuse their own editor nonce with another object's id in the admin course, quiz and question editor AJAX actions. An authenticated instructor can change other instructors' courses, alter quiz answers and trash questions.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["learnpress","lms","package","wordpress"],"not_affected_if":["no-instructor-accounts","patched-version"],"how_to_check":"- Check the installed LearnPress version in the plugin header or `wp plugin get learnpress --field=version`\n- Confirm whether instructors have access to the admin course, quiz and question editors","fix":"- Update LearnPress to `4.4.10` or later","status":"open","published_at":"2026-10-20T11:17:19+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:16:35+00:00","updated_at":"2026-10-25T04:16:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:16:35Z","model":"claude-haiku-5-5","output":{"fix":"- Update LearnPress to `4.4.10` or later","reach":"internet","title":"LearnPress: instructors can edit other instructors' courses, quizzes and questions","impact":"medium","summary":"LearnPress before 4.4.10 lets an instructor reuse their own editor nonce with another object's id in the admin course, quiz and question editor AJAX actions. An authenticated instructor can change other instructors' courses, alter quiz answers and trash questions.","category":"package","nicknames":[],"who_cares":["wordpress","learnpress","lms"],"confidence":0.7,"needs_auth":"yes","worst_case":"instructor edits other instructors' courses, quiz answers and questions","analyst_note":"","how_to_check":"- Check the installed LearnPress version in the plugin header or `wp plugin get learnpress --field=version`\n- Confirm whether instructors have access to the admin course, quiz and question editors","needs_analyst":false,"not_affected_if":["no-instructor-accounts","patched-version"],"who_is_affected":"Sites running LearnPress before 4.4.10 that have instructor accounts able to use the course editor. The flaw needs a logged-in instructor; sites with only administrators or students as users are not exposed to this path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000568,"input_tokens":3343,"output_tokens":468,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113353':13A,16A '-2026':12A,15A '4.4.10':23B,63C 'action':46B,84C 'admin':39B,71C,74C,78C 'ajax':45B,83C 'allow':85C 'alter':55B,108C 'anoth':33B,102C 'answer':57B,112C 'authent':48B,92C 'author':67C 'chang':51B,110C 'contain':64C 'content':91C 'cours':7A,40B,54B,72C,109C 'cve':11A,14A 'edit':4A 'editor':30B,44B,73C,76C,80C,99C 'generic':98C 'id':36B,105C 'instructor':2A,6A,26B,49B,53B,86C,90C,93C 'learnpress':1A,17B,21B,61C 'let':24B 'lms':18B 'lp':82C 'lp-ajax':81C 'miss':66C 'modifi':88C 'nonc':31B,100C 'object':34B,103C 'packag':19B 'paramet':106C 'question':10A,43B,60B,79C,115C 'quiz':41B,56B,75C,111C 'quizz':8A 'reus':27B,95C 'trash':59B,114C 'vulner':68C 'wordpress':20B","nicknames":[],"mitigations":[],"who_affected":"Sites running LearnPress before 4.4.10 that have instructor accounts able to use the course editor. The flaw needs a logged-in instructor; sites with only administrators or students as users are not exposed to this path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T11:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113353","severity":null,"published_at":"2026-10-20T11:17:19+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}