CVE-2026-4365: 
WordPress vulnerability analysis and mitigation

CVE-2026-4365 is a Missing Authorization vulnerability in the LearnPress – WordPress LMS Plugin (by ThimPress) that allows unauthenticated attackers to delete any quiz answer option via a crafted POST request. It affects all versions up to and including 4.3.2.8. The vulnerability was published on April 14, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Wordfence).

The root cause is a missing authorization check (CWE-862) on the delete_question_answer() function within inc/Ajax/EditQuestionAjax.php. The plugin exposes a wp_rest nonce in the public frontend HTML via the lpData JavaScript object, making it accessible to unauthenticated visitors. This nonce is used as the sole security gate for the lp-load-ajax AJAX dispatcher (inc/Ajax/AbstractAjax.php), but the delete_question_answer action performs no capability or ownership verification beyond nonce validation. An attacker can retrieve the nonce from any public page of the site and submit a crafted POST request to delete arbitrary quiz answer options (GitHub Advisory, Wordfence).

Successful exploitation allows unauthenticated attackers to permanently delete any quiz answer option across all courses hosted on the affected WordPress site, directly undermining course content integrity and quiz functionality. This can disrupt e-learning operations, corrupt assessments, and degrade the availability of course materials for students and instructors. There is no confidentiality impact, but the high integrity and availability impacts make this particularly damaging for educational platforms relying on LearnPress (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.034% (0.054% per Feedly data), placing it in the lower percentiles for near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity — requiring only a publicly available nonce retrievable from any frontend page — makes it trivially exploitable if targeted (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the LearnPress plugin (version ≤ 4.3.2.8) using tools like WPScan, Shodan, or by inspecting page source for LearnPress-specific assets.
2. Nonce Extraction: Visit any public-facing page of the target site and inspect the HTML source or JavaScript variables for the lpData object, which contains the wp_rest nonce exposed to unauthenticated visitors.
3. Identify Target Answer ID: Browse quiz pages or use the WordPress REST API to enumerate quiz question answer option IDs that are to be deleted.
4. Craft Malicious POST Request: Send a POST request to the site's AJAX endpoint (e.g., /?lp-load-ajax=1 or admin-ajax.php) with the action set to delete_question_answer, the extracted nonce, and the target answer ID as parameters.
5. Achieve Unauthorized Deletion: The server processes the request without any capability or ownership check, permanently deleting the specified quiz answer option (GitHub Advisory, Wordfence).

• Network: Unusual POST requests to WordPress AJAX endpoints (e.g., /?lp-load-ajax=1 or /wp-admin/admin-ajax.php) with action=delete_question_answer from unauthenticated or anonymous IP addresses.
• Logs: WordPress access logs showing repeated POST requests to AJAX handlers with delete_question_answer action parameter from non-authenticated sessions; multiple requests in short succession targeting different answer IDs.
• Application: Unexpected disappearance of quiz answer options from LearnPress courses without corresponding admin activity in WordPress audit logs; quiz questions with missing or reduced answer sets.
• Database: Unexplained deletions in the LearnPress quiz answer tables (e.g., wp_learnpress_question_answers) without corresponding authenticated user actions.

Update the LearnPress plugin to a version newer than 4.3.2.8, which includes the fix for the missing authorization check on delete_question_answer() (GitHub Advisory, Wordfence). As a temporary workaround if immediate patching is not possible, consider using a Web Application Firewall (WAF) rule to block unauthenticated POST requests containing delete_question_answer in the request body. Additionally, administrators should audit other AJAX handlers in the plugin codebase for similar missing authorization patterns (Wordfence Weekly Report).

Wordfence reported the vulnerability as part of its weekly WordPress vulnerability intelligence report for April 13–19, 2026, highlighting it as a critical missing authorization issue (Wordfence Weekly Report). Sucuri also included it in their April 2026 vulnerability patch roundup (Sucuri Blog). Social media activity was observed on Mastodon and Bluesky shortly after disclosure, with security community accounts sharing the CVE details, though no significant researcher commentary or controversy was noted.