WordPress LearnPress plugin 4.4.3-4.4.6 - Unauthenticated Quiz Answer Disclosure vulnerability

Unauthenticated Quiz Answer Disclosure vulnerability discovered by Nicat Sultanov in WordPress Plugin LearnPress versions 4.4.3-4.4.6...

CVE-2026-86446 LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint

The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken...

CVE-2026-81196

The MasterStudy LMS WordPress Plugin (versions before 3.7.46 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to properly verify ownership of quiz question identifiers, which allows users with instructor access to view quiz questions belonging to other instruct...

CVE-2026-81196 MasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations...