CVE-2026-3225 Details
Description
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answers due to a missing capability check in the delete_question_answer() function of the EditQuestionAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check, and the QuestionAnswerModel::delete() method only validates minimum answer counts without checking user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete answer options from any quiz question on the site.
A vulnerability exists in the LearnPress WordPress LMS Plugin, specifically in versions through 4.3.2.8. The issue arises from a missing capability check in the 'delete_question_answer()' function within the 'EditQuestionAjax' class. While the 'AbstractAjax::catch_lp_ajax()' dispatcher verifies a wp_rest nonce, it does not perform a 'current_user_can()' check. Additionally, the 'QuestionAnswerModel::delete()' method only checks for minimum answer counts without considering user capabilities. This flaw enables authenticated attackers with Subscriber-level access or higher to delete answer options from any quiz question on the site.
Users are advised to update the LearnPress WordPress LMS Plugin to version 4.3.3 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 23, 2026CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LearnPress | <= 4.3.2.8 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | New CVE Received | [email protected] |