CVE-2026-86445 Overview
The LearnPress WordPress plugin before version 4.4.7 contains a broken access control flaw in one of its administrative template handlers. The handler fails to verify the user's capabilities before returning quiz question data. Unauthenticated attackers can retrieve the text, identifier, and type of every published quiz question on the site. Attackers can also perform keyword searches across this content. LearnPress otherwise treats this material as non-public. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated remote attackers can enumerate and search all published quiz questions across LearnPress-powered learning sites, undermining assessment integrity.
Affected Products
- LearnPress WordPress plugin versions prior to 4.4.7
- WordPress sites using LearnPress for course and quiz delivery
- Learning Management System (LMS) deployments relying on LearnPress quiz confidentiality
Discovery Timeline
- 2026-09-16 - CVE-2026-86445 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-86445
Vulnerability Analysis
LearnPress exposes an administrative template handler intended for authenticated administrative workflows. The handler processes requests that return quiz question payloads including question text, unique identifier, and question type. It also supports a keyword search parameter that filters returned questions.
The handler does not perform a capability check against the requesting user. As a result, requests originating from unauthenticated visitors receive the same response as authorized administrators. Attackers can iterate through the endpoint or issue targeted keyword searches to extract the full set of published quiz questions. The exposure is confidentiality-only; the flaw does not modify data or affect availability.
Root Cause
The root cause is missing authorization enforcement in an administrative template handler. LearnPress relies on the handler being reached only through the admin interface, but the endpoint is reachable over the network without authentication. WordPress plugins must explicitly call capability checks such as current_user_can() before returning privileged data. The absence of that check in the vulnerable handler allows anonymous data retrieval.
Attack Vector
Exploitation requires only network access to the target WordPress site. The attacker issues HTTP requests to the vulnerable LearnPress template handler, optionally providing a keyword search term to focus enumeration. No authentication, user interaction, or elevated privileges are required. See the WPScan Vulnerability Report for technical details on the affected handler.
Detection Methods for CVE-2026-86445
Indicators of Compromise
- Unauthenticated HTTP requests to LearnPress administrative template handler endpoints originating from unexpected client IPs.
- Repeated requests containing keyword search parameters against LearnPress endpoints in a short time window, indicating enumeration.
- Anomalous spikes in admin-ajax.php or LearnPress plugin route traffic from clients without valid session cookies.
Detection Strategies
- Review WordPress and web server access logs for unauthenticated requests targeting LearnPress admin template routes and correlate with response sizes indicative of bulk data return.
- Deploy Web Application Firewall (WAF) rules that flag anonymous access to LearnPress administrative handlers.
- Baseline normal LearnPress traffic patterns and alert on deviations, particularly requests without valid authentication cookies.
Monitoring Recommendations
- Forward WordPress access and PHP error logs to a centralized logging platform for retention and correlation.
- Monitor for outbound data patterns consistent with quiz content scraping such as sequential enumeration.
- Enable file integrity monitoring on the LearnPress plugin directory to identify unauthorized modification alongside exploitation attempts.
How to Mitigate CVE-2026-86445
Immediate Actions Required
- Upgrade the LearnPress plugin to version 4.4.7 or later on all WordPress instances.
- Audit web server logs for prior unauthenticated access to LearnPress administrative template handlers.
- Rotate any quiz content that must remain confidential if exposure is confirmed.
Patch Information
Update LearnPress to version 4.4.7 or newer through the WordPress plugin manager or by deploying the updated plugin package. Refer to the WPScan Vulnerability Report for advisory details and patched-version confirmation.
Workarounds
- Restrict access to WordPress administrative endpoints at the reverse proxy or WAF layer, allowing only trusted source IPs.
- Temporarily disable the LearnPress plugin on affected sites where the upgrade cannot be applied immediately.
- Apply WAF signatures that block unauthenticated requests to LearnPress admin template handler routes.
# Example WP-CLI command to update the LearnPress plugin
wp plugin update learnpress --version=4.4.7
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
