CVE-2026-13765 Overview
CVE-2026-13765 is a sensitive information exposure vulnerability in the LearnPress – WordPress LMS Plugin for Create and Sell Online Courses. The flaw affects all versions up to and including 4.4.1 and stems from the check_answer functionality. Unauthenticated attackers can extract correct-answer markers, full option lists, explanations, and question content for any quiz question hosted on the site. The exposure extends to quiz content belonging to paid courses that the attacker has not enrolled in. The vulnerability is tracked under CWE-862: Missing Authorization.
Critical Impact
Unauthenticated attackers can harvest quiz answers, option lists, and explanations from any course — including paid courses — undermining course monetization and assessment integrity.
Affected Products
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (all versions ≤ 4.4.1)
- WordPress sites running LearnPress with quiz functionality enabled
- Paid LearnPress courses relying on quiz access control
Discovery Timeline
- 2026-07-17 - CVE-2026-13765 published to NVD
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-13765
Vulnerability Analysis
The vulnerability resides in the LearnPress REST API surface, specifically in code paths tied to the check_answer operation exposed through the plugin's user controller. The plugin fails to enforce authorization checks before returning quiz question data to the caller. As a result, the endpoint discloses correct-answer markers, complete option arrays, explanation text, and question content to any HTTP client.
Because the endpoint is reachable without authentication, the attacker does not need a WordPress account or course enrollment to invoke it. The disclosure applies uniformly to free and paid courses, breaking the enrollment-based access boundary that instructors rely on. This exposure directly damages course integrity and can be scripted to bulk-extract quiz banks.
Root Cause
The root cause is a missing authorization check ([CWE-862]) in the LearnPress REST API user controller. Callable methods in class-lp-rest-users-controller.php return quiz question payloads without verifying the caller's enrollment status or authentication state. Related helper code in class-lp-course-no-required-enroll.php and lp-template-functions.php also participates in returning quiz data along paths that do not gate access to answer metadata. The upstream fix is visible in the LearnPress changeset diff on WordPress.org.
Attack Vector
The attack is remote and network-based, requiring no privileges and no user interaction. An attacker issues unauthenticated HTTP requests to the vulnerable REST API endpoint, iterating quiz or question identifiers to enumerate content. The response body contains the correct-answer markers and explanations, allowing full harvesting of quiz banks at scale. See the Wordfence Vulnerability Report and the LearnPress REST API User Controller source for the vulnerable code paths.
Detection Methods for CVE-2026-13765
Indicators of Compromise
- Unauthenticated HTTP requests to LearnPress REST endpoints under /wp-json/lp/v1/ referencing check_answer or user controller routes.
- Sequential enumeration of quiz or question IDs originating from a single client IP or user-agent.
- Anomalous spikes in outbound response sizes from LearnPress REST API routes without corresponding authenticated sessions.
- Access logs showing REST API calls to LearnPress endpoints without preceding wp-login.php authentication events.
Detection Strategies
- Inspect web server access logs for high-volume, unauthenticated calls to LearnPress REST routes with varying question_id or quiz_id parameters.
- Deploy a WordPress-aware WAF rule that flags unauthenticated requests to LearnPress check_answer endpoints.
- Correlate REST API request patterns with enrollment records to identify callers accessing quiz data for courses they are not enrolled in.
Monitoring Recommendations
- Enable verbose logging on the WordPress REST API and forward logs to a centralized analytics platform.
- Monitor for enumeration patterns across LearnPress endpoints and alert on threshold breaches.
- Track plugin version inventory across WordPress deployments to confirm patch adoption of LearnPress above 4.4.1.
How to Mitigate CVE-2026-13765
Immediate Actions Required
- Update the LearnPress plugin to a version above 4.4.1 that includes the fix referenced in the LearnPress changeset.
- Audit web server access logs for prior unauthenticated calls to LearnPress REST endpoints and identify potentially harvested quiz content.
- Rotate or regenerate quiz banks for high-value paid courses if evidence of enumeration exists.
Patch Information
The LearnPress maintainers addressed the missing authorization check in a release after 4.4.1. The remediation adds enrollment and capability checks before the plugin returns quiz answer data. Site administrators should apply the update through the WordPress plugin management interface or via WP-CLI. See the Wordfence Vulnerability Report for the fixed version reference.
Workarounds
- Restrict access to the WordPress REST API for unauthenticated users using a security plugin or reverse-proxy rules until the patch is deployed.
- Temporarily disable public quiz previews or set affected courses to require enrollment before content is loaded.
- Deploy WAF signatures blocking unauthenticated requests to LearnPress check_answer and related REST routes.
# Update LearnPress via WP-CLI
wp plugin update learnpress
wp plugin get learnpress --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
