CVE-2026-10630
Received Received - Intake

Insecure Direct Object Reference in WP Courses LMS Plugin

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: Wordfence

Description
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to read any other user's quiz answers and scores by enumerating the incrementing resultID value via the wpcq_get_quiz_result AJAX action. The only access control on this endpoint is a nonce check (wpc_nonce) that is exposed to every logged-in user on the frontend, providing no meaningful authorization barrier.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-10630
EUVD
EUVD-2026-65192

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_courses_lms wp_courses_lms to 3.2.29 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the WP Courses LMS WordPress plugin. It allows authenticated attackers with custom-level access or higher to read other users' quiz answers and scores by manipulating the 'resultID' parameter. The issue occurs due to missing validation on a user-controlled key, enabling enumeration of incrementing resultID values through the wpcq_get_quiz_result AJAX action.

Detection Guidance

To detect this vulnerability, check WordPress sites using the WP Courses LMS plugin up to version 3.2.29. Monitor for unauthorized access to quiz results via the wpcq_get_quiz_result AJAX action. Look for unusual enumeration of resultID values or repeated requests to this endpoint by authenticated users.

Impact Analysis

If you use the WP Courses LMS plugin, attackers could access sensitive quiz data from other users, including answers and scores. This could lead to privacy breaches, intellectual property theft, or unfair advantages in educational settings. The impact is limited to authenticated users with specific access levels.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data (quiz answers) without consent. For HIPAA, if health-related quiz data is involved, it may breach confidentiality requirements. Organizations using this plugin must address it to maintain compliance with data protection regulations.

Mitigation Strategies

Immediately update the WP Courses LMS plugin to the latest version beyond 3.2.29. If an update is unavailable, disable the plugin temporarily. Review server logs for suspicious activity related to the wpcq_get_quiz_result endpoint. Implement additional access controls to restrict AJAX action access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10630. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart