Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2026-113353

CVE-2026-113353: LearnPress Authorization Bypass Vulnerability

CVE-2026-113353 is an authorization bypass flaw in LearnPress that allows instructors to modify content belonging to other instructors. This post explains its impact, affected versions, and mitigation steps.

Published:

CVE-2026-113353 Overview

CVE-2026-113353 is a missing authorization vulnerability in the LearnPress WordPress plugin before version 4.4.10. The flaw affects the admin_course_editor, admin_quiz_editor, and admin_question_editor AJAX actions handled by lp-ajax. Authenticated instructors can reuse a generic editor nonce issued for their own content and substitute another object's id parameter. This allows them to modify courses, change quiz answers, and trash questions owned by other instructors on the same site. The vulnerability maps to CWE-639, Authorization Bypass Through User-Controlled Key, and affects multisite learning platforms where multiple instructors share the WordPress backend.

Critical Impact

Any authenticated instructor can tamper with other instructors' courses, quizzes, and questions, undermining content integrity across LearnPress-based learning management systems.

Affected Products

  • LearnPress WordPress plugin versions prior to 4.4.10
  • WordPress sites running LearnPress 4.4.9.1 and earlier
  • Multi-instructor learning platforms using the LearnPress legacy editor AJAX handlers

Discovery Timeline

  • 2026-10-20 - CVE-2026-113353 published to NVD
  • 2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-113353

Vulnerability Analysis

The vulnerability resides in inc/admin/class-lp-admin-ajax.php, which registers the admin_course_editor, admin_quiz_editor, and admin_question_editor AJAX events through the learn-press/ajax/admin-load action. These handlers verify a generic editor nonce tied to the requesting instructor but never confirm that the instructor owns the object identified by the id request parameter. The checks terminate at capability and nonce validation, skipping per-object authorization in class-lp-admin-editor-course.php and the companion quiz and question editors.

Because the nonce is scoped to the instructor rather than the target resource, any instructor who can legitimately open an editor for one of their own items receives a reusable token. That token is accepted for arbitrary id values, enabling cross-instructor modification of course metadata, quiz answer keys, and question trash operations.

Root Cause

The root cause is a missing ownership check between the nonce holder and the target object identifier. The code trusts the nonce as proof of both authentication and authorization, violating the principle that authorization must be evaluated against each requested resource.

Attack Vector

An authenticated instructor sends a crafted admin-ajax.php POST request with action=admin_course_editor (or the quiz or question equivalent), a valid instructor-issued nonce, and an id parameter pointing to another instructor's object. The request succeeds and persists the attacker-controlled changes without producing an authorization error.

php
 			do_action( 'learn-press/ajax/admin-load', __CLASS__ );
 
 			$ajax_events = array(
-				'search_items' => 'modal_search_items',
+				//'search_items' => 'modal_search_items',
 				'update-payment-order',
 				// Update ordering of payments when user changing.
 				'update-payment-status',
 				// Enable type payment
 
 				// admin editor
-				'admin_course_editor',
-				'admin_quiz_editor',
-				'admin_question_editor',
+				//'admin_course_editor',
+				//'admin_quiz_editor',
+				//'admin_question_editor',
 				'duplicator',
 				// Duplicate course, lesson, quiz, question.
-				'modal_search_items',
+				//'modal_search_items',
 				// Used to search courses on LP Order
 				//'modal_search_users',
 				// Used to search users on LP Order

Source: GitHub Commit 77087dc. The patch removes the vulnerable legacy editor handlers from the registered AJAX event list, breaking the exploitation path entirely.

Detect Identity Attacks the Moment Authentication Fails

Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.

Stop Identity Attacks

Detection Methods for CVE-2026-113353

Indicators of Compromise

  • POST requests to /wp-admin/admin-ajax.php with action values of admin_course_editor, admin_quiz_editor, or admin_question_editor originating from non-admin instructor accounts
  • Course, quiz, or question records with post_author values that no longer match the user who last modified them in the WordPress revisions log
  • Unexpected trashed questions or altered quiz answer keys reported by instructors who did not perform the change

Detection Strategies

  • Correlate WordPress audit logs with LearnPress object ownership to flag edits where the acting user is not the object owner
  • Enable verbose logging on admin-ajax.php and alert on repeated calls to the three legacy editor actions from the same instructor account targeting varied id values
  • Review the LearnPress plugin version across all managed WordPress sites and inventory any instance earlier than 4.4.10

Monitoring Recommendations

  • Monitor WordPress user activity through a web application firewall or SIEM for anomalous AJAX action frequency per instructor
  • Track modifications to wp_posts entries of post types lp_course, lp_quiz, and lp_question and alert when the editor differs from the author
  • Baseline normal instructor behavior and alert on cross-author object modifications

How to Mitigate CVE-2026-113353

Immediate Actions Required

  • Upgrade LearnPress to version 4.4.10 or later on every WordPress site that uses the plugin
  • Audit instructor accounts for recent modifications to courses, quizzes, and questions owned by other users and roll back unauthorized changes
  • Rotate WordPress nonces by forcing user re-authentication after the upgrade

Patch Information

The LearnPress maintainers addressed CVE-2026-113353 in version 4.4.10 by commenting out the admin_course_editor, admin_quiz_editor, admin_question_editor, search_items, and modal_search_items entries in the $ajax_events array of class-lp-admin-ajax.php. Review the GitHub Commit Details, the LearnPress Changelog, and the VulnCheck Advisory on LearnPress for complete remediation details.

Workarounds

  • Temporarily restrict the Instructor role or limit instructor accounts to trusted staff until the upgrade is applied
  • Deploy a WAF rule that blocks admin-ajax.php requests with action=admin_course_editor, action=admin_quiz_editor, or action=admin_question_editor from non-administrator sessions
  • Disable the LearnPress plugin on sites where instructor content isolation cannot be guaranteed
bash
# ModSecurity rule example to block legacy LearnPress editor AJAX actions
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,id:1026113353,phase:2,deny,status:403,msg:'Block LearnPress legacy editor AJAX (CVE-2026-113353)'"
  SecRule ARGS:action "@rx ^(admin_course_editor|admin_quiz_editor|admin_question_editor)$" \
    "t:lowercase"

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne