The vulnerability is an insecure direct object reference that allows authenticated users with custom-level access or higher to enumerate the resultID parameter exposed by the wpcq_get_quiz_result AJAX action. This enumeration reveals other users’ quiz answers and scores, compromising the confidentiality of user-generated educational content. The weakness stems from missing validation of a user-controlled key and relies only on a nonce that is available to any logged‑in user, resulting in no meaningful authorization check.

Hookandhook’s WP Courses LMS – Online Courses Builder plugin for WordPress, versions up to and including 3.2.29, is affected. All installations using these versions are vulnerable until updated.

The CVSS score of 4.3 places the issue in the medium range. EPSS data is not provided, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to be authenticated to the site and possess at least custom-level privileges to perform the enumeration via the AJAX endpoint. The required exploitation is a simple authenticated HTTP request; no additional privileges or advanced techniques are needed beyond maintaining a logged-in session.