CVE-2026-113353: LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers
Published Oct 20, 2026
·Updated
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admincourseeditor, adminquizeditor and adminquestioneditor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.
Affected Software
1 affected component
thimpress LearnPress<4.4.10
Event History
Oct 20, 2026
CVE Published
via MITRE·10:41 AM
Data Sourced
via MITRE·10:41 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which LearnPress versions should be updated?
Update to LearnPress 4.4.10 or later. Versions before 4.4.10 are affected.
2
Can an unauthenticated attacker exploit this issue?
No. Exploitation requires an authenticated instructor account and a valid generic editor nonce for that account.