CVE-2026-10630

Name of the Vulnerable Software and Affected Versions WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses versions prior to 3.2.30

Description An Insecure Direct Object Reference occurs due to missing validation on a user-controlled key. Authenticated attackers with custom-level access and above can read quiz answers and scores of other users by enumerating the resultID parameter via the wpcq get quiz result AJAX action. The endpoint relies on a nonce check (wpc nonce) that is exposed to all logged-in users on the frontend, which fails to provide an effective authorization barrier.

Recommendations Update the plugin to a version newer than 3.2.29. As a temporary mitigation, restrict access to the wpcq get quiz result AJAX action for users with custom-level access.