CVE-2026-113353 — LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instruc…
Published: 2026-10-20 · CVSS: 5.3 · CVSS 4.0
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7