{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/thimpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-13765"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LearnPress – WordPress LMS Plugin for Create and Sell Online Courses \u003c= 4.4.1"],"_cs_severities":["high"],"_cs_tags":["wordpress","plugin","vulnerability","information-exposure","web"],"_cs_type":"advisory","_cs_vendors":["ThimPress"],"content_html":"\u003cp\u003eA critical sensitive information exposure vulnerability, identified as CVE-2026-13765, exists in the LearnPress - WordPress LMS Plugin for Create and Sell Online Courses, affecting all versions up to and including 4.4.1. This flaw, present in the \u003ccode\u003echeck_answer\u003c/code\u003e functionality, allows unauthenticated attackers to bypass authorization controls and extract highly sensitive information. This includes correct answer markers, full option lists, detailed explanations, and the content of any quiz question hosted on the site. The impact extends to questions belonging to paid courses, enabling attackers to obtain valuable educational content without enrollment or payment. The vulnerability stems from missing authorization checks (CWE-862) within the plugin's code, enabling a direct attack against web applications utilizing the plugin.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies a WordPress website running the vulnerable LearnPress plugin.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an HTTP GET or POST request targeting a LearnPress endpoint associated with quiz functionality, specifically invoking the \u003ccode\u003echeck_answer\u003c/code\u003e logic.\u003c/li\u003e\n\u003cli\u003eThe malicious request includes parameters identifying a specific quiz and question, such as \u003ccode\u003equiz_id\u003c/code\u003e and \u003ccode\u003equestion_id\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDue to a missing authorization check, the LearnPress plugin processes the request without verifying the attacker's authentication or enrollment status for the course.\u003c/li\u003e\n\u003cli\u003eThe vulnerable \u003ccode\u003echeck_answer\u003c/code\u003e function executes and, instead of merely validating an answer, inadvertently retrieves and exposes sensitive details about the question and its solution.\u003c/li\u003e\n\u003cli\u003eThe web server returns an HTTP 200 OK response containing the quiz question's correct answer, the complete list of options, the explanation, and the question content.\u003c/li\u003e\n\u003cli\u003eThe attacker parses the response to successfully extract the sensitive educational content, including details from paid courses they are not enrolled in.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-13765 leads to a significant compromise of intellectual property and the integrity of online educational content. Attackers can obtain full quiz solutions, including correct answers, alternative options, and detailed explanations, for any quiz on the platform. This bypasses paywalls and enrollment requirements for paid courses, effectively devaluing the educational offerings and potentially leading to lost revenue for course creators and organizations. The exposure also allows malicious actors to distribute answers, facilitating cheating, and undermining the academic integrity of institutions relying on the LearnPress plugin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-13765 immediately by updating the LearnPress plugin to version 4.4.2 or higher.\u003c/li\u003e\n\u003cli\u003eDeploy the \u003ccode\u003eDetects CVE-2026-13765 Exploitation - LearnPress Information Exposure Attempt\u003c/code\u003e Sigma rule to your SIEM and monitor webserver logs for suspicious access patterns to LearnPress quiz-related endpoints.\u003c/li\u003e\n\u003cli\u003eEnable comprehensive web server logging for HTTP requests, including URI stems and query parameters, to facilitate detection and investigation of exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-17T05:19:31Z","date_published":"2026-07-17T05:19:31Z","id":"https://feed.craftedsignal.io/briefs/2026-07-learnpress-info-exposure/","summary":"An unauthenticated sensitive information exposure vulnerability (CVE-2026-13765) in the LearnPress - WordPress LMS Plugin for Create and Sell Online Courses, versions up to 4.4.1, allows attackers to extract quiz answers, options, explanations, and question content, including for paid courses.","title":"Sensitive Information Exposure in LearnPress WordPress Plugin (CVE-2026-13765)","url":"https://feed.craftedsignal.io/briefs/2026-07-learnpress-info-exposure/"}],"language":"en","title":"CraftedSignal Threat Feed - ThimPress","version":"https://jsonfeed.org/version/1.1"}