LearnPress Missing Authorization Vulnerability Allowing Unauthenticated Deletion of Quiz Answers

A vulnerability exists in the LearnPress WordPress plugin, in all versions through 4.3.2.8, allowing unauthorized deletion of quiz answers. This issue arises from a lack of capability checks in the 'delete_question_answer()' function. The plugin exposes a 'wp_rest' nonce in public frontend HTML, which is used as the sole security measure for the 'lp-load-ajax' AJAX dispatcher. Without any capability or ownership checks, unauthenticated attackers can delete quiz answer options by sending a POST request with the publicly available nonce.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of quiz answer options, potentially disrupting the integrity of quiz data.

Remediation

Users are advised to update the LearnPress WordPress plugin to version 4.3.3 or a newer patched version.