Description

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path. Attackers can supply arbitrary question identifiers during answer insertion, bypassing instructor-boundary restrictions to persistently modify quiz content across courses they do not own.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-03T18:17:24.260Z",
  "pubdate": "2026-09-03T18:17:24.260Z",
  "executiveSummary": "LearnPress WordPress Plugin versions prior to 4.4.6 are susceptible to a Broken Object Level Authorization (BOLA) vulnerability. This security flaw originates from a failure to perform server-side ownership verification during the quiz question answer insertion process.\nThe vulnerability permits an authenticated user with the 'Instructor' role to bypass course boundary restrictions. By manipulating the input parameters associated with the answer insertion request, a malicious instructor can inject, modify, or append answers to quiz questions owned by other instructors within the LearnPress ecosystem.\nThe impact is significant, as it enables unauthorized persistence and manipulation of academic content across the platform. An attacker can effectively sabotage quiz data, alter assessment integrity, and potentially compromise the educational outcomes of courses they do not manage. Exploitation requires valid authentication as an instructor, but does not require higher-level administrative privileges. The vulnerability represents a failure of access control mechanisms to validate that a request originates from an authorized owner of the targeted object, creating a scenario where data integrity is compromised across multi-tenant or multi-instructor WordPress environments.",
  "technicalDetails": "The root cause of this vulnerability is a missing authorization check within the LearnPress backend logic responsible for handling quiz question answer insertions. Specifically, the application fails to validate the ownership of the question identifier (ID) provided by the user during the submission of new answer data. In a secure implementation, the system should verify that the currently authenticated user possesses the 'Instructor' role associated with the specific course or quiz to which the targeted question belongs.\nThe vulnerability exists within the request handling path for inserting question answers. When an instructor submits an answer creation request, the application expects an identifier for the parent question. Because the backend code lacks a conditional check to compare the current user's session ID or assigned capability against the owner ID of the target question, the system blindly accepts the user-supplied identifier. This allows an attacker to supply any valid question ID existing in the WordPress database, regardless of whether that question is part of a course assigned to them.\nExploitation follows a predictable flow: 1) The attacker authenticates as a legitimate instructor within the LearnPress environment. 2) The attacker identifies or enumerates target question IDs belonging to other instructors, often through client-side source inspection or by observing network traffic in their own authorized courses. 3) The attacker initiates an answer insertion request, injecting a malicious or arbitrary answer payload while supplying the target, unauthorized question ID in the request parameters. 4) The application processes the request, lacks an ownership gate, and commits the answer to the database under the victim's quiz question. This results in the unauthorized modification of content.\nThe affected versions include all LearnPress iterations prior to 4.4.6. The attack requires low-level privileges (Instructor) but effectively escalates access to unauthorized data manipulation. Post-exploitation, the attacker has achieved persistent modification of quiz structure. Because the application logic does not scope the 'insert answer' functionality to the instructor's permitted courses, the boundary restriction intended to isolate content between users is rendered non-functional."
}