# CVE-2026-13765: ThimPress LearnPress sensitive information exposure in check_answer Source: https://junglewise.ai/threats/cve-2026-13765-thimpress-learnpress-sensitive-information-exposure-in-check Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-07-17. Updated: 2026-07-17 License: CC BY 4.0 with a link back CVE-2026-13765 · Severity: high · CVSS 7.5 · Published 2026-07-17 LearnPress, a popular WordPress plugin used to create and sell online courses, contains a security flaw that allows unauthorized users to access restricted content. An attacker can view quiz answers, full question lists, and detailed explanations for any course on the site without paying or enrolling. This could lead to a significant loss of revenue for course creators and compromise the integrity of online certifications. Technologies: [ThimPress LearnPress](https://junglewise.ai/threats/technologies/learnpress). Vendors: [ThimPress](https://junglewise.ai/threats/vendors/thimpress). ## Quick answers **Is CVE-2026-13765 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13765 being exploited in the wild. **How severe is CVE-2026-13765?** High severity, with a CVSS score of 7.5, published 17 July 2026. **Which products and versions are affected?** ThimPress LearnPress up to, and including, 4.4.1. **Is there a fix for CVE-2026-13765?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it. **How is CVE-2026-13765 attacked?** It is attacked over the network, in a software library. **Am I affected by CVE-2026-13765?** Check whether you run ThimPress LearnPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## Technical details The LearnPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to missing authorization (CWE-862) in the 'check_answer' functionality. The vulnerability is present in versions up to and including 4.4.1 and is accessible via the REST API (specifically within the LP_REST_Users_Controller). An unauthenticated remote attacker can exploit this to retrieve sensitive quiz data, including correct-answer markers, option lists, and explanations for any quiz question. This bypasses enrollment requirements, allowing access to content from paid courses. A patch appears to be available in subsequent versions based on the provided changeset references. ## Affected products - ThimPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses up to, and including, 4.4.1 ## Timeline - 2026-07-17: advisory: Published by NVD and Wordfence ## References - [https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/course/class-lp-course-no-required-enroll.php](https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/course/class-lp-course-no-required-enroll.php) - [https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/lp-template-functions.php](https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/lp-template-functions.php) - [https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/rest-api/v1/frontend/class-lp-rest-users-controller.php](https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/rest-api/v1/frontend/class-lp-rest-users-controller.php) - [https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/rest-api/v1/frontend/class-lp-rest-users-controller.php](https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/rest-api/v1/frontend/class-lp-rest-users-controller.php) - [https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/rest-api/v1/frontend/class-lp-rest-users-controller.php](https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/rest-api/v1/frontend/class-lp-rest-users-controller.php) - [https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/rest-api/v1/frontend/class-lp-rest-users-controller.php](https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.6/inc/rest-api/v1/frontend/class-lp-rest-users-controller.php) - [https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.1/inc/course/class-lp-course-no-required-enroll.php](https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.1/inc/course/class-lp-course-no-required-enroll.php) ## Related threats - [ThimPress LearnPress broken access control in version 4.4.12](https://junglewise.ai/threats/cve-2026-52713-missing-authorization-vulnerability-in-thimpress-learnpress) - [LearnPress broken access control for subscribers](https://junglewise.ai/threats/cve-2026-42690-subscriber-broken-access-control-in-learnpress-4-4-10-versions) - [ThimPress LearnPress broken access control vulnerability](https://junglewise.ai/threats/cve-2026-115599-missing-authorization-vulnerability-in-thimpress-learnpress) - [ThimPress LearnPress broken access control](https://junglewise.ai/threats/cve-2026-115598-missing-authorization-vulnerability-in-thimpress-learnpress) - [ThimPress LearnPress broken access control in pages](https://junglewise.ai/threats/cve-2026-115597-missing-authorization-vulnerability-in-thimpress-learnpress)