Medium severity · published Mar 23, 2026
CVE-2026-3225
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answers due to a missing capability check in the delete_question_answer() function of the EditQuestionAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check, and the QuestionAnswerModel::delete() method only validates minimum answer counts without checking user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete answer options from any quiz question on the site.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LW
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · thimpress
through 4.3.2.8 · source: vendor
Affected product
LW
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
thimpress
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3225
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3225
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.7/inc/Ajax/AbstractAjax.php#L17
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.7/inc/Ajax/EditQuestionAjax.php#L284
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.7/inc/Models/Question/QuestionAnswerModel.php#L243
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?old_path=/learnpress/tags/4.3.2.8&new_path=/learnpress/tags/4.3.3
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/fc4afb78-fca6-4cc2-8e64-4785d93055e6?source=cve
More from LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
9.8
CVE-2026-104736
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
9.8
CVE-2024-4434
LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection
9.8
CVE-2023-6634
LearnPress <= 4.2.5.7 - Command Injection
9.1
CVE-2026-4365
LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion
8.8
CVE-2024-6589
LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion