CVE-2026-113353

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/LearnPress/learnpress/commit/77087dcdc0e974e8d0844453b4071189fc2c70d2
https://learnpresslms.com/changelog/
https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.php
https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/admin/editor/class-lp-admin-editor-course.php
https://wordpress.org/plugins/learnpress/
https://www.vulncheck.com/advisories/learnpress-before-4.4.10-missing-authorization-via-legacy-editor-ajax-handlers

Configurations

No configuration.

History

20 Oct 2026, 11:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-20 11:17

Updated : 2026-10-20 20:06

NVD link : CVE-2026-113353

Mitre link : CVE-2026-113353

CVE.ORG link : CVE-2026-113353

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-113353", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-113353", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T14:32:42.250134Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "ThimPress", "product": "LearnPress", "versions": [{"status": "affected", "version": "0", "lessThan": "4.4.10", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-20T11:17:19.680", "references": [{"url": "https://github.com/LearnPress/learnpress/commit/77087dcdc0e974e8d0844453b4071189fc2c70d2", "source": "disclosure@vulncheck.com"}, {"url": "https://learnpresslms.com/changelog/", "source": "disclosure@vulncheck.com"}, {"url": "https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.php", "source": "disclosure@vulncheck.com"}, {"url": "https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/admin/editor/class-lp-admin-editor-course.php", "source": "disclosure@vulncheck.com"}, {"url": "https://wordpress.org/plugins/learnpress/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/learnpress-before-4.4.10-missing-authorization-via-legacy-editor-ajax-handlers", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions."}], "lastModified": "2026-10-20T20:06:37.150", "sourceIdentifier": "disclosure@vulncheck.com"}