Security Alert Summary
The LearnPress plugin before 4.4.7 returns unrestricted correctness flags when quiz answers are checked on courses configured to be taken without enrolling. This allowed unauthenticated attackers to obtain the correct answer for every option of a question and the instructor’s explanation for that question.
CVE Details
- CVE ID:
CVE-2026-86446 - Affected product: LearnPress WordPress plugin
- Affected versions: Versions before 4.4.7 (example entry lists 4.4.3 as affected)
- Published: September 17, 2026 at 6:16:51 AM
- Last modified: September 17, 2026 at 1:16:51 PM
- CVSS v3.1 base score: 3.7 (LOW)
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Authentication / privileges / user interaction: No authentication required; privileges required: NONE; user interaction: NONE; attack complexity: HIGH; attack vector: NETWORK; scope: UNCHANGED
- Impact: Confidentiality: LOW; Integrity: NONE; Availability: NONE
- CWE / weakness: CWE-200 (Information Exposure)
Technical Details
The plugin did not restrict the correctness flags returned when a quiz answer was checked on courses configured to be taken without enrolling. As a result, an unauthenticated requester could submit answer checks and receive responses that indicate which options are correct, along with the instructor’s explanation text for the question. The CVE description does not name specific functions or REST endpoints; it describes the lack of restriction on returned correctness flags as the root cause.
The impact is limited to disclosure of quiz answer correctness and associated explanation text. There is no indication in the provided data of direct integrity or availability impacts, or of authentication or privilege bypass beyond this information disclosure.
How This Could Impact Your Website
Consider a site with multiple users: the site owner, instructors (internal staff), and external contributors who create course content. On a course configured to be taken without enrolling, an unauthenticated attacker could extract correct answers and instructor explanations for quiz questions. This may:
- Undermine the value of assessments by exposing answers to learners and third parties.
- Reveal instructor-provided explanations that could contain internal details or phrasing useful for social engineering.
- Increase the risk of targeted phishing or other social engineering against instructors or staff if attacker-gathered information is combined with other data.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and permissions, especially for contributors and instructors.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior related to quiz endpoints or anonymous requests.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
