CVE-2026-4365: LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion
The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the deletequestionanswer() function in all versions up to, and including, 4.3.2.8. The plugin exposes a wprest nonce in public frontend HTML (lpData) to unauthenticated visitors, and uses that nonce as the only security gate for the lp-load-ajax AJAX dispatcher. The deletequestionanswer action has no capability or ownership check. This makes it possible for unauthenticated attackers to delete any quiz answer option by sending a crafted POST request with a publicly available nonce.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4365?
CVE-2026-4365 is considered a critical vulnerability due to its potential for unauthorized deletion of quiz answers.
How do I fix CVE-2026-4365?
To fix CVE-2026-4365, update the LearnPress plugin to version 4.3.2.9 or later where the authorization checks have been implemented.
Who is affected by CVE-2026-4365?
All users of LearnPress versions up to and including 4.3.2.8 are affected by CVE-2026-4365.
What type of vulnerabilities does CVE-2026-4365 represent?
CVE-2026-4365 represents an unauthorized data deletion vulnerability due to a missing capability check.
Is CVE-2026-4365 exploitable remotely?
Yes, CVE-2026-4365 can be exploited remotely since it does not require user authentication.