CVE-2026-10630: WP Courses LMS <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameter
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to read any other user's quiz answers and scores by enumerating the incrementing resultID value via the wpcqgetquizresult AJAX action. The only access control on this endpoint is a nonce check (wpcnonce) that is exposed to every logged-in user on the frontend, providing no meaningful authorization barrier.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Coursesto a version that resolves this vulnerability.Fixed in 3.2.29Patch WP Courses LMS <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameter - Compensating control
Enforce authorization beyond the nonce for the wpcq_get_quiz_result AJAX endpoint so that authenticated users cannot access other users’ quiz answers/scores by enumerating the incrementing 'resultID' parameter; a nonce check on wpc_nonce exposed to logged-in frontend users is not a sufficient access control barrier.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with custom-level access or higher can exploit it. The affected AJAX endpoint relies only on a frontend nonce that is exposed to every logged-in user, rather than verifying that the requester is authorized to view the requested quiz result.
What information can an attacker obtain?
An attacker can read other users' quiz answers and scores. They can do this by enumerating incrementing resultID values through the wpcq_get_quiz_result AJAX action.
Are unauthenticated visitors affected?
No. Exploitation requires an authenticated account with custom-level access or above.
How can I determine whether the plugin version is affected?
Versions up to and including 3.2.29 are affected. Review the installed WP Courses LMS plugin version and treat deployments in that version range as vulnerable.