CVE-2026-113353
Awaiting Analysis Awaiting Analysis - Queue

Missing Authorization in LearnPress Course Editor

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-113353
EUVD
EUVD-2026-104924

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ThimPress LearnPress 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization flaw in LearnPress versions before 4.4.10. It affects the admin_course_editor, admin_quiz_editor, and admin_question_editor lp-ajax actions. Authenticated instructors can exploit their own editor nonce to modify content belonging to other instructors by changing the id parameter. This allows unauthorized alterations to courses, quizzes, and questions.

Detection Guidance

Check LearnPress plugin version. If using version before 4.4.10, the system is vulnerable. Inspect admin AJAX handlers for disabled functions like admin_course_editor, admin_quiz_editor, and admin_question_editor in class-lp-admin-ajax.php.

Impact Analysis

If you are an instructor using LearnPress before 4.4.10, another instructor could modify your courses, quizzes, or questions without permission. This could lead to incorrect course content, altered quiz answers, or deleted questions, disrupting your teaching materials and student experience.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized instructors to modify content belonging to other instructors. This may lead to unauthorized access or alteration of sensitive user data, such as course materials, quiz answers, or user-generated content, which could violate data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Update LearnPress to version 4.4.10 or later immediately. Disable or remove the vulnerable AJAX actions if updating is not possible. Review user roles and permissions to ensure instructors cannot modify content outside their scope.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113353. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...