CVE-2026-86446: LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint
The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken without enrolling.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress LearnPress pluginto a version that resolves this vulnerability.Fixed in 4.4.7 - Compensating control
Restrict access to the LearnPress check-answer REST endpoint (e.g., via web server/WAF rules or network/ACL) to prevent unauthenticated access while remediation is applied.
Event History
Frequently Asked Questions
Which courses are exposed to unauthenticated users?
Courses configured so that quizzes can be taken without enrolling are exposed. An unauthenticated attacker can retrieve correctness information for every option in a question and the instructor's explanation.
What versions need to be remediated?
LearnPress versions before 4.4.7 are affected. Updating to 4.4.7 or later addresses the affected version range described.
What can be done if updating is not immediately possible?
Restrict courses so quizzes cannot be taken without enrollment. This removes the course configuration identified as allowing unauthenticated answer disclosure.