Vapour

**Name of the Vulnerable Software and Affected Versions** WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses versions prior to 3.2.30 **Description** An Insecure Direct Object Reference occurs due to missing validation on a user-controlled key. Authenticated attackers with custom-level access and above can read quiz answers and scores of other users by enumerating the `resultID` parameter via the `wpcq get quiz result` AJAX action. The endpoint relies on a nonce check (`wpc nonce`) that is exposed to all logged-in users on the frontend, which fails to provide an effective authorization barrier. **Recommendations** Update the plugin to a version newer than 3.2.29. As a temporary mitigation, restrict access to the `wpcq get quiz result` AJAX action for users with custom-level access.