Data-Deletion — CraftedSignal Threat Feed

LearnPress WordPress Plugin Unauthorized Data Deletion Vulnerability (CVE-2026-4365)

hello@craftedsignal.io — Tue, 14 Apr 2026 02:16:57 +0000

The LearnPress plugin for WordPress, in versions up to and including 4.3.2.8, is susceptible to unauthorized data deletion. The vulnerability stems from a missing capability check on the delete_question_answer() function. The plugin exposes a wp_rest nonce in public frontend HTML, and this nonce serves as the sole security check for the lp-load-ajax AJAX dispatcher. As the delete_question_answer action lacks capability or ownership validation, unauthenticated attackers can exploit this flaw to delete arbitrary quiz answer options. This is achieved by sending a crafted POST request containing a publicly available nonce. Exploitation does not require any prior authentication.

Attack Chain

An unauthenticated attacker identifies a LearnPress installation with a vulnerable version (<= 4.3.2.8).
The attacker accesses the public frontend of the WordPress site.
The attacker retrieves the wp_rest nonce from the lpData variable in the HTML source code. This nonce is used for AJAX requests.
The attacker crafts a POST request to the wp-admin/admin-ajax.php endpoint.
The crafted POST request includes the action parameter set to delete_question_answer.
The request also includes the nonce parameter with the value of the retrieved wp_rest nonce.
The request includes the answer_id parameter set to the ID of the quiz answer option to be deleted.
The server, lacking proper capability checks, processes the request and deletes the specified quiz answer option from the database. This results in data loss and potentially disrupts the functionality of quizzes within the LearnPress plugin.

Impact

Successful exploitation allows unauthenticated attackers to arbitrarily delete quiz answer options within the LearnPress plugin. This can lead to data loss, disruption of quizzes, and potentially compromise the integrity of educational content. The CVSS v3.1 base score for this vulnerability is 9.1, indicating a critical severity. The number of victims and specific sectors targeted are currently unknown, but any website using the vulnerable LearnPress plugin is at risk.

Recommendation

Upgrade the LearnPress plugin to a version greater than 4.3.2.8 to patch CVE-2026-4365.
Deploy the Sigma rule “Detect LearnPress Unauthorized Data Deletion Attempt” to your SIEM to identify potential exploitation attempts.
Monitor web server logs for POST requests to wp-admin/admin-ajax.php with the action parameter set to delete_question_answer and investigate suspicious activity.

OpenEMR Missing Authorization Allows Unauthorized Data Deletion

hello@craftedsignal.io — Thu, 26 Mar 2026 12:00:00 +0000

OpenEMR, a widely used open-source electronic health records and medical practice management application, is vulnerable to a significant authorization bypass. Specifically, versions prior to 8.0.0.3 lack proper authorization checks in the interface/forms/procedure_order/handle_deletions.php AJAX endpoint. This flaw enables any authenticated user, regardless of their assigned role or privileges, to delete procedure orders, patient answers, and specimen records associated with any patient within the OpenEMR system. This vulnerability poses a serious threat to data integrity and confidentiality. The vendor patched this vulnerability in version 8.0.0.3. Defenders should prioritize identifying and patching vulnerable systems.

Attack Chain

An attacker gains valid credentials to an OpenEMR instance, potentially through phishing, credential stuffing, or other means.
The attacker logs into the OpenEMR web application with their valid, but potentially low-privilege, account.
The attacker crafts a malicious AJAX request targeting the vulnerable endpoint: interface/forms/procedure_order/handle_deletions.php.
The crafted request specifies the IDs of procedure orders, answers, or specimens that the attacker wishes to delete, regardless of the associated patient.
Due to the missing authorization check, the OpenEMR application processes the deletion request without verifying the attacker’s permissions.
The specified patient data (procedure orders, answers, or specimens) is permanently deleted from the OpenEMR database.
The attacker can repeat this process to delete additional patient data, potentially causing significant disruption or data loss.

Impact

The missing authorization vulnerability in OpenEMR allows any authenticated user to delete sensitive patient data, including procedure orders, answers to medical questionnaires, and specimen records. Successful exploitation could lead to data loss, compliance violations (e.g., HIPAA), and disruption of medical practice operations. The precise number of potentially affected OpenEMR instances is unknown, but given the widespread use of OpenEMR in medical practices, the impact could be substantial.

Recommendation

Upgrade all OpenEMR installations to version 8.0.0.3 or later to remediate CVE-2026-34053.
Implement network monitoring for requests to interface/forms/procedure_order/handle_deletions.php and investigate any unusual activity.
Deploy the Sigma rule to detect potential exploitation attempts by monitoring HTTP requests to the vulnerable endpoint.