Is CVE-2026-82023 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-82023?

CVE-2026-82023 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-82023

Description

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path. Attackers can supply arbitrary question identifiers during answer insertion, bypassing instructor-boundary restrictions to persistently modify quiz content across courses they do not own.