CVE-2026-3225: LearnPress WordPress LMS Auth Bypass Flaw

CVE-2026-3225 Overview

The LearnPress – WordPress LMS Plugin for WordPress contains a Missing Authorization vulnerability (CWE-862) that allows authenticated attackers to delete quiz question answers without proper authorization checks. The vulnerability exists in the delete_question_answer() function within the EditQuestionAjax class, where the AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but fails to perform a current_user_can() capability check. Additionally, the QuestionAnswerModel::delete() method only validates minimum answer counts without verifying user capabilities.

Critical Impact

Authenticated attackers with Subscriber-level access can delete answer options from any quiz question on the site, potentially disrupting educational content and learning assessments.

Affected Products

• LearnPress – WordPress LMS Plugin versions up to and including 4.3.2.8

Discovery Timeline

• 2026-03-23 - CVE CVE-2026-3225 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-3225

Vulnerability Analysis

This vulnerability is classified as Missing Authorization (CWE-862), a common weakness pattern where an application fails to verify that a user has the necessary permissions before performing a sensitive action. In the context of this WordPress plugin, the attack is network-accessible and requires only low-privilege authenticated access (Subscriber-level or above), making it relatively straightforward to exploit.

The vulnerability enables unauthorized modification of quiz data integrity without requiring any user interaction from the site administrator. While the confidentiality impact is minimal, the integrity of quiz content can be compromised, allowing malicious users to disrupt learning management system operations by removing answer choices from quizzes.

A proof-of-concept exploit is publicly available, increasing the risk of active exploitation in the wild. Organizations running affected versions should prioritize remediation.

Root Cause

The root cause lies in the architectural separation between authentication and authorization within the LearnPress AJAX handling mechanism. While the AbstractAjax::catch_lp_ajax() dispatcher correctly validates the wp_rest nonce (ensuring the request comes from a legitimate authenticated session), it fails to implement the critical current_user_can() check that WordPress provides for capability-based access control.

The QuestionAnswerModel::delete() method compounds this issue by only enforcing business logic validation (minimum answer counts) without any user capability verification. This means any authenticated user, regardless of their role, can invoke the deletion functionality as long as they possess a valid nonce.

Attack Vector

The attack leverages the network-accessible AJAX endpoint exposed by the LearnPress plugin. An attacker must first authenticate to the WordPress site with at least Subscriber-level privileges. Once authenticated, the attacker can:

1. Obtain a valid wp_rest nonce through normal site interaction
2. Craft AJAX requests targeting the delete_question_answer() function in the EditQuestionAjax class
3. Specify arbitrary quiz question IDs and answer option IDs in the request
4. Successfully delete answer options from any quiz, bypassing all authorization checks

The attack requires no user interaction from administrators and can be automated to systematically remove answers across multiple quizzes, potentially causing widespread disruption to educational content.

For detailed technical analysis of the vulnerable code paths, refer to the WordPress LearnPress AJAX Abstract, Edit Question AJAX handler, and Question Answer Model.

Detection Methods for CVE-2026-3225

Indicators of Compromise

• Unusual AJAX requests to LearnPress endpoints from low-privilege user accounts (Subscriber, Customer roles)
• Database logs showing deletion of quiz answer records without corresponding admin activity
• Web server logs containing repeated POST requests to /wp-admin/admin-ajax.php with lp_ajax action parameters from non-administrative users
• Unexpected reduction in quiz answer options without administrative changes

Detection Strategies

• Monitor WordPress AJAX activity logs for delete_question_answer actions originating from non-admin user sessions
• Implement file integrity monitoring on LearnPress plugin files to detect unauthorized modifications
• Configure web application firewall (WAF) rules to flag suspicious patterns in LearnPress AJAX requests
• Review user activity logs for Subscriber-level accounts making administrative-type plugin requests

Monitoring Recommendations

• Enable detailed WordPress activity logging with plugins that track AJAX calls and database modifications
• Set up alerts for quiz content modifications performed by users without appropriate capabilities
• Regularly audit quiz content integrity to detect unauthorized deletions
• Monitor for known PoC exploit patterns in web traffic

How to Mitigate CVE-2026-3225

Immediate Actions Required

• Update LearnPress plugin to version 4.3.3 or later immediately
• Audit recent quiz modifications for unauthorized deletions, particularly from Subscriber-level accounts
• Review user accounts for suspicious activity patterns and consider revoking access for compromised accounts
• Temporarily restrict Subscriber registration if immediate patching is not possible

Patch Information

The vulnerability has been addressed in LearnPress version 4.3.3. The patch introduces proper capability checks using WordPress's current_user_can() function in the EditQuestionAjax class. Site administrators should update through the WordPress plugin repository or download the patched version directly.

For detailed information on the fix, see the version changeset between 4.3.2.8 and 4.3.3. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Restrict user registration to prevent unauthorized Subscriber account creation until patching is complete
• Implement a Web Application Firewall (WAF) rule to block AJAX requests targeting LearnPress quiz modification endpoints from non-admin users
• Use a security plugin to enforce additional capability checks on LearnPress AJAX endpoints
• Disable the LearnPress plugin temporarily if quizzes are not actively in use and immediate patching is not feasible

# WordPress CLI command to update LearnPress plugin
wp plugin update learnpress --version=4.3.3

# Verify installed version after update
wp plugin list --name=learnpress --fields=name,version,status