CVE-2026-86446

LowCVSS 3.7/10Last modified Sep 18, 2026

Description

The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken without enrolling.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Sep 17, 2026
Last modified
Sep 18, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-864475.3The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unaCVE-2026-864483.7The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously genCVE-2026-864495.3The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in oCVE-2026-864507.5Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal aCVE-2026-864514.3Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data(CVE-2026-864527.5Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input boundCVE-2026-86469.1IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTPCVE-2026-864609.8Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache SyncCVE-2026-864618.8The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5CVE-2026-864629.1Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing CVE-2026-864637.5Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck tCVE-2026-864649.9In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deplo