Authorization bypass in hookandhook WP Courses LMS – Online Courses Builder, eLearning…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to read any other user's quiz answers and scores by enumerating the incrementing resultID value via the wpcq_get_quiz_result AJAX action. The only access control on this endpoint is a nonce check (wpc_nonce) that is exposed to every logged-in user on the frontend, providing no meaningful authorization barrier.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| hookandhook | WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses | up to 3.2.29 | — | No fix listed | CNA |
- WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses Vendorhookandhook Affected up to 3.2.29 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-10630
- 2026-10-03 Alias added: GHSA-9986-2jvx-wmgv
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/83936cda-e868-44f6-be5d-f26086bc4688?source=cve
- https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.29/classes/WPCQ_Ajax.php#L91
- https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.29/classes/WPCQ_Ajax.php#L87
- https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.29/classes/WPCQ_Ajax.php#L28
- https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.28/classes/WPCQ_Ajax.php#L91
- https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.28/classes/WPCQ_Ajax.php#L87
- https://plugins.trac.wordpress.org/browser/wp-courses/tags/3.2.28/classes/WPCQ_Ajax.php#L28
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3660496%40wp-courses&new=3660496%40wp-courses
More hookandhook vulnerabilities
- TI-2024-11287 Missing authorization in hookandhook WP Courses LMS – Online Courses Builder, eLearning… CVSS 3.1HIGH 7.5
- TI-2026-24463 WordPress WP Courses LMS plugin <= 3.2.26 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
- TI-2024-37238 WordPress Post Grid Elementor Addon plugin <= 2.0.18 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-10630 · CVE Program
- CVE-2026-10630 · NVD
- FIRST EPSS
- GHSA-9986-2jvx-wmgv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences