CVE-2026-86446 Overview
CVE-2026-86446 is an information disclosure vulnerability in the LearnPress WordPress plugin versions before 4.4.7. The plugin fails to restrict the correctness flags returned when a quiz answer is checked. Unauthenticated attackers can obtain the correct answer for every option of a question, along with the instructor's explanation, on courses configured to be taken without enrolling. The flaw is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated attackers can extract quiz answers and instructor explanations from public LearnPress courses, undermining assessment integrity.
Affected Products
- LearnPress WordPress plugin versions prior to 4.4.7
- WordPress sites hosting LearnPress courses configured for non-enrolled access
- Learning Management System deployments using vulnerable LearnPress builds
Discovery Timeline
- 2026-09-17 - CVE-2026-86446 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-86446
Vulnerability Analysis
The LearnPress plugin exposes a quiz-checking endpoint that evaluates submitted answers and returns results to the caller. The response payload includes correctness flags for every option in a question rather than only the submitted answer. The response also includes the instructor's explanation text intended for post-submission review.
Because the endpoint is reachable without authentication on courses configured to be taken without enrolling, any remote actor can query it. An attacker can submit arbitrary answers and read the returned flags to deduce the correct option. Repeating this process across every question in a quiz yields a complete answer key.
The issue reflects a business logic flaw combined with over-permissive data exposure. The server-side handler treats correctness data as safe to disclose after any answer check, ignoring that this data should remain confidential until legitimate grading is complete.
Root Cause
The root cause is missing output filtering on the quiz answer verification endpoint. The handler serializes the full answer set with correctness metadata rather than returning only the result for the submitted option. See the WPScan Vulnerability Report for additional technical detail.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker identifies a WordPress site running a vulnerable LearnPress version and enumerates courses configured for open access. The attacker then issues quiz-check requests for each question, parses the returned correctness flags, and reconstructs the complete answer key along with any instructor explanations.
No verified exploit code is publicly available in the referenced advisory. The vulnerability mechanism is described in prose based on the WPScan report.
Detection Methods for CVE-2026-86446
Indicators of Compromise
- Repeated unauthenticated POST or AJAX requests to LearnPress quiz-check endpoints from a single source IP
- High-volume traffic patterns iterating through quiz question identifiers in short time windows
- Access logs showing sequential enumeration of quiz IDs on courses marked as non-enrollment
Detection Strategies
- Inspect WordPress access logs for anomalous request rates against LearnPress AJAX actions related to answer checking
- Correlate unauthenticated requests to LearnPress endpoints with distinct quiz identifiers to identify enumeration behavior
- Alert on user agents and IPs issuing quiz-check calls without an associated authenticated session cookie
Monitoring Recommendations
- Deploy a Web Application Firewall rule to rate-limit LearnPress quiz endpoints for unauthenticated sessions
- Track LearnPress plugin version across all managed WordPress installations and alert on versions below 4.4.7
- Baseline normal quiz submission volume per course and flag deviations that suggest automated scraping
How to Mitigate CVE-2026-86446
Immediate Actions Required
- Upgrade LearnPress to version 4.4.7 or later on all WordPress installations
- Audit course configurations and disable non-enrollment access for courses containing graded quizzes
- Review WordPress access logs for prior enumeration activity against quiz endpoints
Patch Information
The vendor addressed the issue in LearnPress 4.4.7. Site administrators should update through the WordPress plugin dashboard or apply the patched release manually. Confirm the plugin version after update to ensure the fix is active. Reference the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict quiz access to enrolled users only by changing course configuration in LearnPress settings
- Block or rate-limit unauthenticated requests to LearnPress AJAX endpoints at the web server or WAF layer
- Temporarily disable the LearnPress plugin on sites that cannot be updated immediately
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
