---
id: "CVE-2026-113353"
kind: "vulnerability"
aliases: ["CVE-2026-113353"]
title: "LearnPress: instructors can edit other instructors' courses, quizzes and questions"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["learnpress", "lms", "package", "wordpress"]
not_affected_if: ["no-instructor-accounts", "patched-version"]
published_at: "2026-10-20T11:17:19+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:16:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113353", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# LearnPress: instructors can edit other instructors' courses, quizzes and questions

LearnPress before 4.4.10 lets an instructor reuse their own editor nonce with another object's id in the admin course, quiz and question editor AJAX actions. An authenticated instructor can change other instructors' courses, alter quiz answers and trash questions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed LearnPress version in the plugin header or `wp plugin get learnpress --field=version`
- Confirm whether instructors have access to the admin course, quiz and question editors

## Fix

- Update LearnPress to `4.4.10` or later

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113353

## From the sources

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_