CVE-2026-10630: CWE-639 Authorization Bypass Through User-Controlled Key in hookandhook WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses

CVE-2026-10630 is an Insecure Direct Object Reference (IDOR) vulnerability in the WP Courses LMS – Online Courses Builder plugin for WordPress, affecting versions up to 3.2.29. The vulnerability exists due to lack of proper authorization checks on the 'resultID' parameter used in the wpcq_get_quiz_result AJAX action. Authenticated users with custom-level access or above can enumerate incrementing resultID values to access other users' quiz results. The only protection is a nonce check (wpc_nonce) that is accessible to all logged-in users, providing no effective authorization barrier.

An authenticated user with custom-level access or higher can read quiz answers and scores of other users, potentially exposing sensitive assessment data. The vulnerability does not allow modification or deletion of data, nor does it affect availability. The CVSS v3.1 base score is 4.3 (medium severity), reflecting the confidentiality impact with no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles and permissions to limit access to authenticated users with custom-level access or higher. Monitor for updates from the vendor and apply official patches once released.