Executive brief
LearnPress is a WordPress plugin used to create and manage online learning courses and quizzes. The plugin contains a flaw that allows unauthenticated attackers to retrieve sensitive quiz question content—including question text, identifiers, and types—that should normally only be visible to authorized administrators. This exposes the intellectual property and instructional design of course materials.
Technical details
The vulnerability is an information disclosure (CWE-200) caused by missing capability checks in an administrative AJAX template handler named load_content_via_ajax. Unauthenticated attackers can invoke this handler via network requests without any authentication, retrieving all published quiz question details and performing keyword searches across them. The affected versions are before 4.4.7, which introduced proper capability verification. No indication of active exploitation in the wild has been reported.
Affected products
- LearnPress LearnPress before 4.4.7
Timeline
- 2026-09-14: disclosed: Vulnerability publicly disclosed on WPScan
- 2026-09-16: patched: Fix available in version 4.4.7
- 2026-09-28: other: Proof of concept will be published to allow users time to update