CVE-2026-113353: Authorization Bypass Through User-Controlled Key in ThimPress LearnPress
Description
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.
CVSS v4.0
Score 5.3medium
Affected software
ThimPress
LearnPress
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-113353 is an authorization bypass vulnerability affecting LearnPress prior to version 4.4.10. The flaw exists in the admin_course_editor, admin_quiz_editor, and admin_question_editor AJAX actions, where the system fails to properly verify authorization. Authenticated instructors can reuse their own generic editor nonce combined with a different object's ID parameter to alter or trash content owned by other instructors. This vulnerability enables unauthorized content modification within the LearnPress platform.
Potential Impact
An authenticated instructor can modify or delete courses, quiz answers, and questions that belong to other instructors without proper authorization. This could lead to unauthorized content changes, potentially disrupting course integrity and trustworthiness. The CVSS 4.0 base score is 5.3, indicating a medium severity impact.
Mitigation Recommendations
A fix is available in LearnPress version 4.4.10. Users should upgrade to version 4.4.10 or later to remediate this authorization bypass vulnerability. No other mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-20T01:07:46.397Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad747282cdf04f65620acc9
Added to database: 10/20/2026, 10:49:12 UTC
Last enriched: 10/20/2026, 11:03:27 UTC
Last updated: 10/20/2026, 19:06:08 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.