CVE-2026-3225: 
WordPress vulnerability analysis and mitigation

CVE-2026-3225 is a Missing Authorization vulnerability in the LearnPress – WordPress LMS Plugin by ThimPress that allows authenticated attackers with Subscriber-level access or above to delete answer options from any quiz question on the site. It affects all versions of the plugin up to and including 4.3.2.8. The vulnerability was disclosed on March 23, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, ENISA EUVD).

The root cause is a missing capability check (CWE-862) in the delete_question_answer() function within the EditQuestionAjax class. The AbstractAjax::catch_lp_ajax() dispatcher validates a wp_rest nonce — confirming the request is authenticated — but never calls current_user_can() to verify the user has sufficient privileges. Additionally, the QuestionAnswerModel::delete() method only enforces a minimum answer count constraint and performs no authorization check, meaning any authenticated user (Subscriber and above) can invoke the deletion endpoint against any quiz question on the site (Wordfence, Plugin Source – EditQuestionAjax, Plugin Source – AbstractAjax).

Successful exploitation allows any authenticated user — including those with the lowest default WordPress role (Subscriber) — to delete answer options from quiz questions across the entire site. This results in an integrity impact on course content, potentially corrupting quizzes, disrupting e-learning assessments, and degrading the educational experience for all students. There is no confidentiality or availability impact, and the scope is limited to the affected WordPress installation (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.028% (0.000280), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid authenticated session at Subscriber level or above, lowering the barrier for abuse on sites with open registration (Wordfence).

1. Reconnaissance: Identify WordPress sites running the LearnPress plugin (version ≤ 4.3.2.8) via HTTP response headers, plugin enumeration tools (e.g., WPScan), or by checking /wp-content/plugins/learnpress/.
2. Account Registration: Register or obtain a low-privilege account (Subscriber level) on the target site, which is possible on sites with open user registration enabled.
3. Obtain wp_rest Nonce: Log in and retrieve a valid wp_rest nonce from the page source or via the WordPress REST API endpoint (/wp-json/).
4. Identify Target Quiz Question and Answer IDs: Browse the site's quiz content or enumerate quiz question/answer IDs through the LearnPress frontend or API responses.
5. Send Malicious AJAX Request: Craft and send an authenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) invoking the delete_question_answer action, supplying the target answer ID and the obtained nonce — no instructor or admin privileges are required.
6. Confirm Deletion: Verify that the targeted answer option has been removed from the quiz question, confirming successful exploitation (Wordfence, Plugin Source – EditQuestionAjax).

• Network: Repeated POST requests to /wp-admin/admin-ajax.php with action=delete_question_answer (or equivalent LearnPress AJAX action) originating from low-privilege user sessions.
• Logs: WordPress access logs showing authenticated requests to the AJAX endpoint with answer deletion parameters from accounts that are not instructors or administrators; unusual frequency of such requests from a single user account.
• Application: Unexpected removal of answer options from quiz questions, particularly across multiple quizzes or in bulk, without corresponding instructor/admin activity in audit logs.
• Database: Deletions in the LearnPress quiz answer tables (e.g., wp_learnpress_question_answers) attributed to user IDs with Subscriber-level roles.

Users should upgrade the LearnPress – WordPress LMS Plugin to version 4.3.3 or later, which addresses the missing capability check. The patch is available via the WordPress plugin repository changeset from tag 4.3.2.8 to 4.3.3. As a temporary workaround, site administrators can disable open user registration to prevent untrusted users from obtaining Subscriber-level accounts, or use a WordPress security plugin to restrict AJAX endpoint access. Upgrading to the patched version is the recommended and definitive remediation (Wordfence, Plugin Changeset).

Wordfence disclosed and assigned the CVE, publishing it in their weekly WordPress vulnerability report for the period of March 23–29, 2026. Sucuri also included the vulnerability in their March 2026 vulnerability patch roundup. No significant independent researcher commentary or broader media coverage has been identified beyond these standard security publication roundups (Wordfence Weekly Report, Sucuri Roundup).