Junglewise Threat Intelligence

CVE-2026-13765: ThimPress LearnPress sensitive information exposure in check_answer

CVE-2026-13765 · Severity: high · CVSS 7.5 · Published 2026-07-17

Technologies: ThimPress LearnPress. Vendors: ThimPress.

Executive brief

LearnPress, a popular WordPress plugin used to create and sell online courses, contains a security flaw that allows unauthorized users to access restricted content. An attacker can view quiz answers, full question lists, and detailed explanations for any course on the site without paying or enrolling. This could lead to a significant loss of revenue for course creators and compromise the integrity of online certifications.

Technical details

The LearnPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to missing authorization (CWE-862) in the 'check_answer' functionality. The vulnerability is present in versions up to and including 4.4.1 and is accessible via the REST API (specifically within the LP_REST_Users_Controller). An unauthenticated remote attacker can exploit this to retrieve sensitive quiz data, including correct-answer markers, option lists, and explanations for any quiz question. This bypasses enrollment requirements, allowing access to content from paid courses. A patch appears to be available in subsequent versions based on the provided changeset references.

Affected products

  • ThimPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses up to, and including, 4.4.1

Timeline

  • 2026-07-17: advisory: Published by NVD and Wordfence

References

Related threats