Is CVE-2026-113353 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113353 being exploited in the wild.

How severe is CVE-2026-113353?

Medium severity, with a CVSS score of 5.4, published 20 October 2026.

Is there a fix for CVE-2026-113353?

Yes: fixed in LearnPress 4.4.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-113353 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-113353?

Check whether you run LearnPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113353: LearnPress authorization bypass in admin editors

CVE-2026-113353 · Severity: medium · CVSS 5.4 · Published 2026-10-20

LearnPress is a learning management system plugin that allows instructors to create and manage courses, quizzes, and questions. An authenticated instructor can exploit a missing authorization check to modify other instructors' courses, change quiz answers, and delete questions by reusing their own editor nonce with different object IDs. This allows instructors to sabotage or alter colleagues' educational content.

Technologies: LearnPress. Vendors: LearnPress.

Quick answers

Is CVE-2026-113353 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113353 being exploited in the wild.
How severe is CVE-2026-113353?: Medium severity, with a CVSS score of 5.4, published 20 October 2026.
Which products and versions are affected?: LearnPress before 4.4.10.
Is there a fix for CVE-2026-113353?: Yes: fixed in LearnPress 4.4.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113353 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-113353?: Check whether you run LearnPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: LearnPress 4.4.10

Technical details

The vulnerability is a missing authorization check in the admin_course_editor, admin_quiz_editor, and admin_question_editor AJAX actions. An authenticated instructor can reuse their valid nonce token with another instructor's object ID to bypass the authorization control. The attack requires authentication as an instructor but no additional user interaction, allowing privilege abuse within the instructor role.

Affected products

LearnPress LearnPress before 4.4.10

Timeline

2026-10-20: disclosed
2026-10-09: patched: Version 4.4.10 released with security fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.