Unauthorized Deletion in LearnPress WordPress LMS Plugin

CVE-2026-3225

What is CVE-2026-3225?

The LearnPress plugin for WordPress suffers from a vulnerability that allows authenticated attackers to delete quiz question answers without proper authorization. This flaw arises from a missing capability check in the delete_question_answer() function within the EditQuestionAjax class. Although the function verifies a wp_rest nonce, it fails to check whether the current user has the necessary permissions. Consequently, users with Subscriber-level access or higher can manipulate quiz content by deleting answer options from any existing question, posing a significant security risk.

References