Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answers due to a missing capability check in the delete_question_answer() function of the EditQuestionAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check, and the QuestionAnswerModel::delete() method only validates minimum answer counts without checking user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete answer options from any quiz question on the site.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-3225 The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answers due to a missing capability check in the dele… https://www.cve.org/CVERecord?id=CVE-2026-3225
Post summary
CVE-2026-3225 reports a missing capability check in LearnPress that can lead to unauthorized deletion of quiz question answers; no PoC, exploit, or patch information is included.
🚨*CVE* CVE-2026-3225 The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answers due to a missing capability check in the dele… https://www.cve.org/CVERecord?id=CVE-2026-3225 ----- Traducción: CVE-2026-3225 El … http://infoflow.cloud`
Post summary
CVE-2026-3225 exposes a missing capability check in the LearnPress WordPress LMS plugin, allowing users to delete quiz answers without authorization.