The vulnerability stems from missing authorization checks in the admin_course_editor, admin_quiz_editor and admin_question_editor AJAX handlers of LearnPress. Because any authenticated instructor can reuse the generic editor nonce with a different object id, they can alter other instructors' courses, change quiz answers or delete questions. This weakness falls under CWE‑639 and results in unauthorized data modification within the learning management system.

ThimPress LearnPress plugins before version 4.4.10 are affected. Specific code paths include /inc/admin/class-lp-admin-ajax.php and /inc/admin/editor/class-lp-admin-editor-course.php in releases such as 4.4.9.1, up to but not including 4.4.10. Any WordPress site that has an older LearnPress installation is vulnerable.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in CISA KEV. An attacker must be a logged‑in instructor; once authenticated, the requirement is only to know the target's object id and re‑use the valid nonce. There is no special privilege escalation beyond the instructor role, so exploitation is relatively straightforward within the instructor’s own account. The impact is limited to content modification but can undermine the integrity of the LMS for other teachers.