CVE-2026-13765 is a missing authorization vulnerability in the LearnPress WordPress LMS plugin (up to and including version 4.4.1). The issue resides in the check_answer feature, which fails to properly restrict access, enabling unauthenticated attackers to retrieve sensitive quiz data such as correct-answer markers, all answer options, explanations, and question content. This exposure affects quizzes including those in paid courses, potentially compromising course content confidentiality.

The vulnerability allows unauthorized users to extract sensitive quiz content without authentication, exposing correct answers and course material that should be restricted to enrolled users. This can undermine the integrity of paid courses and lead to unauthorized access to intellectual property.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's quiz functionality where possible and monitor for updates from the vendor. Avoid exposing quiz endpoints publicly if feasible.