The vulnerability arises from a missing capability check in the delete_question_answer() function of the EditQuestionAjax class. This flaw allows any authenticated user with a Subscriber role or higher to delete answer options from any quiz question. The consequence is a direct compromise of data integrity for course content, potentially disrupting the learning experience and undermining trust in the platform. The weakness is a classic case of missing authorization (CWE‑862).

The affected product is the LearnPress – WordPress LMS Plugin developed by thimpress. All releases up to and including version 4.3.2.8 are impacted. No other product variants or versions are listed as affected.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only that the attacker be authenticated; any user with Subscriber-level access or higher can trigger the deletion. Because the attack vector is authenticated, the likelihood of exploitation depends on the site’s user base and role distribution, but the impact remains significant if attackers obtain legitimate credentials. The overall risk can be considered moderate to high for sites that rely heavily on accurate quiz data.