Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

LearnPress Plugin for WordPress Allows Unauthenticated Data Deletion

CVE-2026-4365
Summary

The LearnPress plugin for WordPress can be exploited by hackers to delete quiz answers without permission. This is because the plugin doesn't check if someone is authorized to make changes. To protect your data, update to a version of LearnPress that fixes this issue or consider replacing the plugin with a more secure alternative.

Original title
The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the `delete_question_answer()` function in all versions up to, and including, 4....
Original description
The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the `delete_question_answer()` function in all versions up to, and including, 4.3.2.8. The plugin exposes a `wp_rest` nonce in public frontend HTML (`lpData`) to unauthenticated visitors, and uses that nonce as the only security gate for the `lp-load-ajax` AJAX dispatcher. The `delete_question_answer` action has no capability or ownership check. This makes it possible for unauthenticated attackers to delete any quiz answer option by sending a crafted POST request with a publicly available nonce.
nvd CVSS3.1 9.1
Vulnerability type
CWE-862 Missing Authorization
Published: 14 Apr 2026 · Updated: 14 Apr 2026 · First seen: 14 Apr 2026