CVE-2026-10630: WP Courses LMS Information Disclosure Flaw

CVE-2026-10630 Overview

CVE-2026-10630 is an Insecure Direct Object Reference (IDOR) vulnerability in the WP Courses LMS plugin for WordPress. The flaw affects all versions up to and including 3.2.29. The wpcq_get_quiz_result AJAX action fails to validate that the requesting user owns the referenced resultID. Authenticated attackers with custom-level access or above can enumerate incrementing resultID values to read any other user's quiz answers and scores. The endpoint's only protection is a wpc_nonce check exposed to every logged-in frontend user, which provides no meaningful authorization boundary [CWE-639].

Critical Impact
Authenticated users can enumerate resultID values via the wpcq_get_quiz_result AJAX endpoint to disclose other users' quiz answers and scores across the entire WordPress site.

Affected Products

WP Courses LMS – Online Courses Builder plugin for WordPress
All versions up to and including 3.2.29
Vulnerable file: classes/WPCQ_Ajax.php

Discovery Timeline

2026-08-25 - CVE-2026-10630 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-10630

Vulnerability Analysis

The WP Courses LMS plugin exposes an AJAX action, wpcq_get_quiz_result, that returns quiz submission data associated with a numeric resultID parameter. The handler accepts a user-controlled key and queries the corresponding quiz result record without confirming that the record belongs to the current user. Because resultID values are sequential integers, an attacker can iterate through the ID space and retrieve results submitted by any other user on the site.

The endpoint enforces only a wpc_nonce check. WordPress nonces authenticate the origin of a request but do not authorize the requesting user against the target object. Any subscriber-level or custom-role user rendering the frontend receives a valid nonce, so the check does not restrict access.

Root Cause

The root cause is missing object-level authorization in the AJAX handler in classes/WPCQ_Ajax.php at lines 28, 87, and 91 of tags 3.2.28 and 3.2.29. The plugin trusts the resultID supplied by the client and never compares the stored result's owner with the current user ID before returning quiz data.

Attack Vector

Exploitation requires an authenticated session with custom-level access or above. The attacker submits POST requests to admin-ajax.php with action=wpcq_get_quiz_result, a valid wpc_nonce, and an incrementing resultID value. The server returns the corresponding quiz answers and scores regardless of ownership, enabling bulk extraction of quiz records. See the Wordfence Vulnerability Report and the vulnerable WPCQ_Ajax.php source for further technical detail.

Detection Methods for CVE-2026-10630

Indicators of Compromise

High volumes of POST requests to /wp-admin/admin-ajax.php with action=wpcq_get_quiz_result from a single authenticated session.
Sequential or rapidly incrementing values of the resultID parameter within a short time window.
Requests to the wpcq_get_quiz_result action originating from low-privilege user accounts that do not normally consume quiz data.

Detection Strategies

Parse WordPress access logs for enumeration patterns against wpcq_get_quiz_result and alert on requests where resultID increments by one across many requests.
Correlate authenticated user IDs with the volume of quiz result reads and flag accounts exceeding baseline access to quiz records they do not own.
Enable WordPress audit logging plugins to record AJAX actions and review anomalies against the wpc_nonce reuse pattern.

Monitoring Recommendations

Deploy web application firewall rules that rate-limit repeated wpcq_get_quiz_result requests per session.
Monitor plugin version inventories across WordPress deployments and alert on hosts still running WP Courses LMS <= 3.2.29.
Review database query logs for unusual read patterns against the plugin's quiz result tables.

How to Mitigate CVE-2026-10630

Immediate Actions Required

Update the WP Courses LMS plugin to a version later than 3.2.29 once the vendor publishes a fix that adds ownership validation to wpcq_get_quiz_result.
Audit existing user accounts and remove custom or subscriber roles that are not strictly required for site operation.
Review recent access logs for enumeration of the wpcq_get_quiz_result action and rotate credentials of any accounts implicated.

Patch Information

At the time of NVD publication, all versions up to and including 3.2.29 are vulnerable. Track the WordPress plugin change log for the fixed release. A proper patch must validate that the current user owns the requested resultID before returning data, rather than relying solely on the wpc_nonce check.

Workarounds

Restrict registration and disable low-privilege account creation until a patched version is installed.
Deploy a WAF rule that blocks or challenges POST requests to admin-ajax.php carrying action=wpcq_get_quiz_result from non-administrator sessions.
Temporarily disable the WP Courses LMS plugin on high-value sites if quiz result confidentiality is required and no fix is available.

bash

# Example ModSecurity rule to block enumeration of wpcq_get_quiz_result
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026106300,\
   msg:'Block WP Courses LMS IDOR CVE-2026-10630'"
  SecRule ARGS:action "@streq wpcq_get_quiz_result" \
    "chain"
    SecRule &ARGS:resultID "@gt 0"