CVE-2026-3225: LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answers due to a missing capability check in the deletequestionanswer() function of the EditQuestionAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catchlpajax() dispatcher verifies a wprest nonce but performs no currentusercan() check, and the QuestionAnswerModel::delete() method only validates minimum answer counts without checking user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete answer options from any quiz question on the site.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3225?
CVE-2026-3225 has a medium severity level due to its potential impact on quiz data integrity.
How do I fix CVE-2026-3225?
To fix CVE-2026-3225, upgrade the LearnPress plugin to a version above 4.3.2.8 where the authorization check has been implemented.
Who is affected by CVE-2026-3225?
Users of the LearnPress plugin for WordPress versions up to and including 4.3.2.8 are affected by CVE-2026-3225.
What vulnerabilities does CVE-2026-3225 introduce?
CVE-2026-3225 introduces the risk of unauthorized deletion of quiz answers by authenticated users with subscriber-level access.
Is CVE-2026-3225 an easy vulnerability to exploit?
Yes, CVE-2026-3225 is considered easy to exploit due to the lack of proper access controls in the affected function.