CVE-2026-10630CWE-639

CVE-2026-10630

Medium · published August 25, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
18.9
In the wild
Unconfirmed
What it is

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to read any other user's quiz answers and scores by enumerating the incrementing resultID value via the wpcq_get_quiz_result AJAX action. The only access control on this endpoint is a nonce check (wpc_nonce) that is exposed to every logged-in user on the frontend, providing no meaningful authorization barrier.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00276 · 18.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-25T06:16Z
References (8)
https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.28/classes/WPCQ_Ajax.php#L28 · [email protected]https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.28/classes/WPCQ_Ajax.php#L87 · [email protected]https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.28/classes/WPCQ_Ajax.php#L91 · [email protected]https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.29/classes/WPCQ_Ajax.php#L28 · [email protected]https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.29/classes/WPCQ_Ajax.php#L87 · [email protected]https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.29/classes/WPCQ_Ajax.php#L91 · [email protected]https://plugins.trac.wordpress.org/changeset?reponame=&old=3660496%40wp-courses&new=3660496%40wp-courses · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/83936cda-e868-44f6-be5d-f26086bc4688?source=cve · [email protected]
EPSS history
Timeline
  • 26 AUG 07:28Z
    EPSS moved — → 0%
    epss
  • 25 AUG 01:26Z
    WP Courses LMS <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameter
    cvelistv5