Missing Authorization Vulnerability in LearnPress by ThimPress

CVE-2026-113353

What is CVE-2026-113353?

LearnPress prior to version 4.4.10 contains a vulnerability that enables authenticated instructors to manipulate content belonging to other instructors. Specifically, through the admin_course_editor, admin_quiz_editor, and admin_question_editor lp-ajax actions, instructors can exploit a flaw in nonce verification. This allows them to alter course materials, modify quiz submissions, and delete questions by reusing their own nonce with an unauthorized object's ID parameter. This vulnerability underscores the importance of strict authorization checks in content management systems to prevent unauthorized data manipulation.

References