Description
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the check_answer. This makes it possible for unauthenticated attackers to extract the correct-answer markers, full option lists, explanations, and question content for any quiz question on the site — including questions belonging to paid courses the attacker is not enrolled in.
Published: 2026-07-17
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The LearnPress WordPress LMS plugin allows unauthenticated users to access the /lp/v1/users/check-answer and /start-quiz endpoints, revealing full quiz data including correct answers, option lists, explanations, and even content from paid courses. This vulnerability, classified under CWE‑862, enables attackers to gather privileged educational content without authorization, potentially compromising user privacy and the integrity of paid course offerings.

Affected Systems

All installations of thimpress LearnPress WordPress LMS Plugin versions 4.4.1 and earlier are affected. The flaw exists in the default code handling quiz endpoints and has been demonstrated in releases up to and including 4.4.1, as evidenced by the PHP source references in the plugin repository.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity, while the EPSS of <1% suggests exploitation is unlikely at this time. The vulnerability is not listed in CISA KEV, but the lack of authentication precludes any defensive barrier; an attacker simply needs to issue HTTP requests to the exposed endpoints. The impact is limited to data leakage and potential commercial loss, with no immediate code execution or system compromise.

Generated by OpenCVE AI on July 31, 2026 at 00:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update LearnPress to the latest patched release that removes unauthenticated access to the quiz endpoints.
  • If an upgrade cannot be performed immediately, implement a custom capability filter to block unauthenticated requests to /lp/v1/users/check-answer and /start-quiz endpoints.
  • Configure the plugin or site settings to restrict quiz content visibility to enrolled users, ensuring paid course material is not publicly accessible.

Generated by OpenCVE AI on July 31, 2026 at 00:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/course/class-lp-course-no-required-enroll.php#L145 cve-icon
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/lp-template-functions.php#L1422 cve-icon
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/rest-api/v1/frontend/class-lp-rest-users-controller.php#L181 cve-icon
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/rest-api/v1/frontend/class-lp-rest-users-controller.php#L434 cve-icon
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/rest-api/v1/frontend/class-lp-rest-users-controller.php#L54 cve-icon
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/rest-api/v1/frontend/class-lp-rest-users-controller.php#L80 cve-icon
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.1/inc/course/class-lp-course-no-required-enroll.php#L145 cve-icon
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.1/inc/lp-template-functions.php#L1422 cve-icon
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.1/inc/rest-api/v1/frontend/class-lp-rest-users-controller.php#L181 cve-icon
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.1/inc/rest-api/v1/frontend/class-lp-rest-users-controller.php#L434 cve-icon
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.1/inc/rest-api/v1/frontend/class-lp-rest-users-controller.php#L54 cve-icon
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.1/inc/rest-api/v1/frontend/class-lp-rest-users-controller.php#L80 cve-icon
https://plugins.trac.wordpress.org/changeset?reponame=&old=3603546%40learnpress&new=3603546%40learnpress cve-icon
https://www.wordfence.com/threat-intel/vulnerabilities/id/ee3bbf20-43fd-4977-b0ba-b81e7a3810d0?source=cve cve-icon
History

Fri, 17 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 17 Jul 2026 07:30:00 +0000

Type Values Removed Values Added
First Time appeared Thimpress
Thimpress learnpress – Wordpress Lms Plugin For Create And Sell Online Courses
Wordpress
Wordpress wordpress
Vendors & Products Thimpress
Thimpress learnpress – Wordpress Lms Plugin For Create And Sell Online Courses
Wordpress
Wordpress wordpress

Fri, 17 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
Description The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the check_answer. This makes it possible for unauthenticated attackers to extract the correct-answer markers, full option lists, explanations, and question content for any quiz question on the site — including questions belonging to paid courses the attacker is not enrolled in.
Title LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Thimpress Learnpress – Wordpress Lms Plugin For Create And Sell Online Courses
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-17T18:05:38.965Z

Reserved: 2026-06-29T19:46:50.351Z

Link: CVE-2026-13765

cve-icon Vulnrichment

Updated: 2026-07-17T12:35:03.390Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T00:45:05Z

Weaknesses