CVE-2026-10630

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to read any other user's quiz answers and scores by enumerating the incrementing resultID value via the wpcq_get_quiz_result AJAX action. The only access control on this endpoint is a nonce check (wpc_nonce) that is exposed to every logged-in user on the frontend, providing no meaningful authorization barrier.

• CWE-639

• https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.28/classes/WPCQ_Ajax.php#L28
• https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.28/classes/WPCQ_Ajax.php#L87
• https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.28/classes/WPCQ_Ajax.php#L91
• https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.29/classes/WPCQ_Ajax.php#L28
• https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.29/classes/WPCQ_Ajax.php#L87
• https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.29/classes/WPCQ_Ajax.php#L91
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3660496%40wp-courses&new=3660496%40wp-courses
• https://www.wordfence.com/threat-intel/vulnerabilities/id/83936cda-e868-44f6-be5d-f26086bc4688?source=cve

Published

Aug 25, 2026

Last Modified

Aug 26, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10623The PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Ass…4.3
• CVE-2026-10624A vulnerability has been found in SourceCodester Human Resou…4.3
• CVE-2026-10627The Events Manager – Calendar, Bookings, Tickets, and more! …5.3
• CVE-2026-10628The Points and Rewards for WooCommerce plugin for WordPress …4.3
• CVE-2026-10629SIP signaling stack in Verizon IMS (unspecified version) imp…7.4
• CVE-2026-1063A vulnerability has been found in bastillion-io Bastillion u…4.7
• CVE-2026-10634Zephyr's native TCP stack iterates the global connection lis…5.3
• CVE-2026-10635On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MM…6.3
• CVE-2026-10636In Zephyr's IPv4 IGMP implementation, igmp_send() in subsys/…3.7
• CVE-2026-10637subsys/net/ip/ipv6_mld.c:mld_send() read the packet interfac…7.1
• CVE-2026-10638subsys/net/ip/icmpv6.c reads the network interface from a ne…7.5
• CVE-2026-10639In Zephyr's native IPv4 stack, icmpv4_handle_echo_request() …4.8