Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the `delete_question_answer()` function in all versions up to, and including, 4.3.2.8. The plugin exposes a `wp_rest` nonce in public frontend HTML (`lpData`) to unauthenticated visitors, and uses that nonce as the only security gate for the `lp-load-ajax` AJAX dispatcher. The `delete_question_answer` action has no capability or ownership check. This makes it possible for unauthenticated attackers to delete any quiz answer option by sending a crafted POST request with a publicly available nonce.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
DECLINING
| Date | Total | Labels |
|---|
| 2026-04-14 | 6 | Disclosure5Patch1 |
| 2026-04-15 | 1 | General1 |
| 2026-04-17 | 1 | Disclosure1 |
| 2026-04-18 | 1 | General1 |
Top 5 Trending CVEs: 1 - CVE-2026-27303 2 - CVE-2026-34197 3 - CVE-2026-5194 4 - CVE-2026-4365 5 - CVE-2026-34621 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard
Post summary
The text merely lists several trending CVEs without offering any technical or actionable information.
Data integrity remains a major concern. CVE-2026-4365 in WordPress highlights how missing capabilities lead to unauthorized deletion. In agentic systems, ensure your RAG pipelines and vector databases have strict, least-privilege access controls.
Post summary
The post announces CVE-2026-4365, noting that missing capabilities in WordPress allow unauthorized deletion, without mentioning exploits or patches.
🚨 CVE-2026-4365 — CVSS 9.1/10 █████████░ The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/0j4dxiIc3i
Post summary
CVE-2026-4365 exposes LearnPress plugin to unauthorized data deletion due to a missing capability check, with a critical severity of CVSS 9.1/10, and a patch is now available.
⚡ New CVE Alert: CVE-2026-4365 📊 Severity: 9.1 🚨 Risk Level: Critical 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4365 #CVE-2026-4365 #CVE #Critical #Wordpress #CyberSecurity #InfoSec https://t.co/V5enwXd9au
Post summary
The tweet announces CVE‑2026‑4365 as a critical Wordpress vulnerability with a CVSS score of 9.1, but provides no PoC, exploit, patch, or detailed technical information.
CVE-2026-4365 The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the `delete_question_answer()` function in all vers… https://www.cve.org/CVERecord?id=CVE-2026-4365
Post summary
The text announces a CVE‑2026‑4365 vulnerability in LearnPress that allows unauthorized data deletion due to a missing capability check on the delete_question_answer() function.
CVE-2026-4365 Unauthorized Data Deletion in LearnPress Plugin for WordPress Up to 4.3.2.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4365
Post summary
The post announces CVE-2026-4365, a vulnerability that permits unauthorized data deletion in LearnPress WordPress plugin versions up to 4.3.2.8.
[CVE-2026-4365: CRITICAL] WordPress LearnPress plugin up to version 4.3.2.8 has a vulnerability allowing unauthorized data deletion through a missing capability check in `delete_question_answer()`, using a pub...#cve,CVE-2026-4365,#cybersecurity https://cvefind.com/CVE-2026-4365
Post summary
The tweet announces a critical vulnerability in WordPress LearnPress plugin that enables unauthorized data deletion due to a missing capability check in the delete_question_answer() function.
🚨 CRITICAL — CVE-2026-4365 The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on th… CVSS 9.1 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-4365 #WordPress #CyberSecurity #InfoSec
Post summary
A critical vulnerability (CVE-2026‑4365) in the LearnPress WordPress plugin is disclosed with a CVSS of 9.1 and no patch yet, but no PoC, exploit code, or evidence of active exploitation.
🚨 CVE-2026-4365: LearnPress <= 4.3.2.8 - Missing A... Publicly exposed wp_rest nonce + missing authz checks = unauthenticated quiz answer nuking via AJAX - classic WordPress ... https://zerodaysignal.com/vulnerability/CVE-2026-4365 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
A new CVE-2026-4365 affecting LearnPress versions up to 4.3.2.8 allows unauthenticated deletion of quiz answers via AJAX because of missing authorization checks, but no PoC, exploit code, patch, or active exploitation reports are included.