CyberRota Analysis
AI-GeneratedThe LearnPress WordPress Plugin prior to version 4.4.6 is vulnerable due to a broken object-level authorization flaw, allowing authenticated users with the Instructor role to manipulate quiz answers owned by other instructors. This vulnerability enables attackers to bypass ownership checks, potentially leading to unauthorized modifications of quiz content across multiple courses. WordPress site administrators using this plugin should prioritize updating to mitigate the risk of content tampering.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path. Attackers can supply arbitrary question identifiers during answer insertion, bypassing instructor-boundary restrictions to persistently modify quiz content across courses they do not own.