CVE-2026-82023— LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert
Quick assessment
Affected
ThimPress LearnPress
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
LearnPress WordPress 插件在 4.4.6 版本之前存在一个对象级授权失效（broken object-level authorization）漏洞。该漏洞允许拥有“讲师”（Instructor）角色的已认证攻击者，通过利用答案插入路径中缺失的属主检查，向其他讲师所属的测验题目中添加答案。攻击者可以在插入答案时提供任意的题目标识符，从而绕过讲师边界限制，对其未拥有的课程中的测验内容进行永久性修改。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| ThimPress | LearnPress | < 4.4.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82023
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert
Source: CVE Program / CVE List V5
Vulnerability Description
LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path. Attackers can supply arbitrary question identifiers during answer insertion, bypassing instructor-boundary restrictions to persistently modify quiz content across courses they do not own.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ThimPress | LearnPress | 0 ~ 4.4.6 | - |
|
II. Public POCs for CVE-2026-82023
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82023
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-82023 (1)
IV. Related Vulnerabilities
Same product: LearnPress
-
CVE-2026-82024
LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Ques -
CVE-2026-78125
LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order S -
CVE-2026-12976
LearnPress < 4.4.4 - Subscriber+ Sensitive Information Expos -
CVE-2026-12971
LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery -
CVE-2026-12970
LearnPress < 4.4.1 - Reflected XSS via c_search
Same vendor: ThimPress
-
CVE-2026-82024
LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Ques -
CVE-2026-77823
LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Inj -
CVE-2026-75982
LearnPress <= 4.4.4 - Missing Authorization to Authenticated -
CVE-2026-66458
WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerab -
CVE-2026-15464
WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Sto
Same weakness: CWE-863
-
CVE-2026-82302
Incorrect Authorization in Kibana Leading to Unauthorized Co -
CVE-2026-82299
Incorrect Authorization in Kibana Leading to Information Dis -
CVE-2026-82298
Incorrect Authorization in Kibana Leading to Denial of Servi -
CVE-2026-78583
Incorrect Authorization in Kibana Leading to Privilege Escal -
CVE-2026-85166
n8n before 2.36.2 Credential Exfiltration via Workflow Tool
V. Comments for CVE-2026-82023
No comments yet