MEDIUM
hookandhook
CVE published 2026-08-25
CVE-2026-10630
The WP Courses LMS plugin for WordPress has an Insecure Direct Object Reference vulnerability allowing authenticated attackers to read quiz answers and scores of other users. This medium-severity vulnerability exists in all versions up to and including 3.2.29 due to missing validation on the 'resultID' parameter. Attackers with custom-level access and above can exploit this by enumerating the incrementing [truncated]