What the vulnerability does
01Description
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to read any other user's quiz answers and scores by enumerating the incrementing resultID value via the wpcq_get_quiz_result AJAX action. The only access control on this endpoint is a nonce check (wpc_nonce) that is exposed to every logged-in user on the frontend, providing no meaningful authorization barrier.
Explanation of Vulnerability in Simple Terms
02Summary
WP Courses LMS versions up to 3.2.29 contain an authorization bypass vulnerability that allows authenticated users to read data they should not have access to. An attacker with a low-privilege account can manipulate user-controlled parameters to bypass access controls and view sensitive information. No user interaction is required beyond initial login.
What an attacker can do
03Attacker Capabilities
Read data belonging to other users or restricted course content by manipulating request parameters.
Potential impact on your site
04Site Impact
Enrolled students or low-privilege users can access course materials, grades, or data they should not see.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege account on the site; no special network access required.
Key dates
06Disclosure timeline
August 25, 2026
CVE published
