# CVE-2026-82023: LearnPress broken object-level authorization in quiz answer insertion

Source: https://junglewise.ai/threats/cve-2026-82023-learnpress-broken-object-level-authorization-in-quiz-answer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82023 · Severity: medium · CVSS 4.3 · Published 2026-09-03

LearnPress is a WordPress plugin that creates and manages online learning platforms with courses, lessons, and quizzes. The vulnerability allows instructors to bypass ownership restrictions and modify quiz content (answers) in courses they do not own, compromising the integrity of quiz assessments across the platform.

Technologies: [ThimPress LearnPress](https://junglewise.ai/threats/technologies/learnpress). Vendors: [ThimPress](https://junglewise.ai/threats/vendors/thimpress).

## Quick answers

**Is CVE-2026-82023 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82023 being exploited in the wild.

**How severe is CVE-2026-82023?** Medium severity, with a CVSS score of 4.3, published 3 September 2026.

**Which products and versions are affected?** ThimPress LearnPress before 4.4.6.

**Is there a fix for CVE-2026-82023?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82023 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82023?** Check whether you run ThimPress LearnPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken object-level authorization (CWE-863) flaw in the quiz answer insertion endpoint of LearnPress before version 4.4.6. The vulnerable code path fails to validate that the authenticated instructor owns the quiz question before accepting answer submissions, allowing attackers to supply arbitrary question identifiers and insert answers into quizzes across courses they lack authorization for. The attack requires authentication with the Instructor role and network access to the quiz answer API endpoint; no user interaction or elevated privileges are needed beyond the Instructor role. An attacker can persistently modify quiz answers, corrupting educational content and potentially affecting student grading and learning outcomes. A patch is available in version 4.4.6 and later.

## Affected products

- ThimPress LearnPress before 4.4.6

## Timeline

- 2026-09-03: disclosed

## References

- [https://wordpress.org/plugins/learnpress/](https://wordpress.org/plugins/learnpress/)
- [https://www.vulncheck.com/advisories/learnpress-wordpress-plugin-broken-object-level-authorization-via-quiz-answer-insert](https://www.vulncheck.com/advisories/learnpress-wordpress-plugin-broken-object-level-authorization-via-quiz-answer-insert)

## Related threats

- [ThimPress LearnPress broken access control in version 4.4.12](https://junglewise.ai/threats/cve-2026-52713-missing-authorization-vulnerability-in-thimpress-learnpress)
- [LearnPress broken access control for subscribers](https://junglewise.ai/threats/cve-2026-42690-subscriber-broken-access-control-in-learnpress-4-4-10-versions)
- [ThimPress LearnPress broken access control vulnerability](https://junglewise.ai/threats/cve-2026-115599-missing-authorization-vulnerability-in-thimpress-learnpress)
- [ThimPress LearnPress broken access control](https://junglewise.ai/threats/cve-2026-115598-missing-authorization-vulnerability-in-thimpress-learnpress)
- [ThimPress LearnPress broken access control in pages](https://junglewise.ai/threats/cve-2026-115597-missing-authorization-vulnerability-in-thimpress-learnpress)