CVE-2026-10630

Executive Summary

CVE-2026-10630 is an Insecure Direct Object Reference (IDOR) vulnerability in the WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress, affecting all versions up to and including 3.2.29. The flaw resides in the wpcq_get_quiz_result AJAX action, where the resultID parameter is accepted without proper authorization validation. Authenticated attackers with custom-level access or higher can enumerate and read any other user's quiz answers and scores. The only protection is a nonce check exposed to all logged-in users, meaning any authenticated user can fully exploit the flaw. The vulnerability is confirmed unpatchable from vendor sources, with no patch, workaround, or public PoC currently available.

Technical Analysis

The vulnerability is classified as CWE-639 (Insecure Direct Object Reference), a subclass of broken access control issues. The affected component is the AJAX handler for the wpcq_get_quiz_result action within the WP Courses LMS plugin (versions ≤ 3.2.29). The flawed mechanism is the handling of a resultID parameter, which is expected to reference a specific quiz result record in the WordPress database.

The core flaw: the AJAX endpoint does not verify that the authenticated user making the request owns the quiz result being retrieved. The only access control mechanism implemented is a nonce check (wpc_nonce). Nonces in WordPress are designed to prevent CSRF (Cross-Site Request Forgery), not to provide authentication or authorization. In this implementation, the nonce is rendered in the frontend for every logged-in user, meaning it is fully accessible and provides no barrier to an attacker. Because the resultID values are sequential incrementing integers, an attacker can trivially enumerate valid IDs exhaustively.

The attack surface is the WordPress AJAX API — any authenticated user (custom-level role or higher) can send an HTTP POST or GET request to admin-ajax.php with the action=wpcq_get_quiz_result parameter and an arbitrary resultID. The absence of a capability check (e.g., verifying current_user_can() or comparing the requesting user's ID against the result owner) allows the endpoint to leak data belonging to other users.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms a low confidentiality impact with no integrity or availability impact, requiring only low privileges and no user interaction, with no attack complexity.

Exploitation Scenarios

No public PoC or exploit code exists for this CVE at the time of writing. The attack chain below is inferred from the vulnerability class (IDOR) and the specific parameters described in the NVD entry.

Step 1: Reconnaissance / Target Identification The attacker first authenticates as any user with at least "custom" level access on a WordPress site running the vulnerable plugin. Custom-level access is typically a custom role with basic permissions. The attacker identifies the presence of the plugin by inspecting page source, admin menus, or probing for the wpcq_get_quiz_result AJAX action. The attacker may also enumerate WordPress users to obtain a list of potential victim user IDs (e.g., via /?author=1 enumeration or the REST API).

Step 2: Triggering the Flaw The attacker crafts an AJAX request to admin-ajax.php with:

• action=wpcq_get_quiz_result
• resultID=<integer> (starting from 1 and incrementing)
• wpc_nonce=<valid nonce> (obtained from any frontend page that renders the quiz interface, as the nonce is exposed to all logged-in users)

The nonce is easily harvested by inspecting the JavaScript variables or hidden form fields on any page containing the quiz functionality.

Step 3: Payload / Execution at Vulnerability-Class Level The attack requires no complex payload — it is a simple parameter manipulation. By iterating resultID values (1, 2, 3, ..., N), the attacker sends successive requests. Because the AJAX handler lacks authorization checks, each request returns the quiz answers and score of the user to whom that result record belongs. The attacker can automate this with a simple script or curl loop.

Step 4: Post-Exploitation Impact The attacker collects quiz answers and scores for all users on the platform. In an LMS context, this data may include assessment responses for certification courses, which could be sensitive personally identifiable information or proprietary assessment content. The attacker could use this to infer training weaknesses, gain unfair advantage in certification exams, or leak student performance data. The confidentiality impact is rated Low (C:L) in the CVSS vector, reflecting that the data is quiz metadata rather than credentials or PII of the highest sensitivity.

Impact Assessment

The business impact of CVE-2026-10630 is moderate in confidentiality terms but significant in trust erosion for any organization relying on the WP Courses LMS plugin for training or certification. Exploitation allows any authenticated user with custom-level access to read all other users' quiz answers and scores, violating the privacy expectations of learners and potentially exposing assessment materials.

Affected Systems: WordPress installations running WP Courses LMS versions ≤ 3.2.29 with the quiz functionality enabled. The plugin is commonly used in eLearning platforms, corporate training portals, and educational institutions.

Blast Radius: The attack requires low privileges (PR:L) and no user interaction (UI:N), meaning any account holder — including students, low-level staff, or external collaborators if user registration is open — can launch the attack. The attack complexity is low (AC:L) and network-based (AV:N), making it trivially exploitable. The confidentiality impact is rated Low (C:L), as the leaked data is quiz results rather than system-level secrets.

CVSS Rationale Reference: The 4.3 score reflects the low severity of the confidentiality breach, constrained by the requirement for an authenticated account and the absence of integrity or availability impact.

Detection Guidance

Sigma Rule

title: WP Courses LMS IDOR - Quiz Result Enumeration
id: 7c3e9a2f-8b4d-4e5f-9a6b-1c2d3e4f5a6b
status: experimental
description: Detects enumeration of wpcq_get_quiz_result AJAX calls targeting WP Courses LMS IDOR vulnerability CVE-2026-10630
logsource:
  category: webserver
  product: apache
  definition: Detection of repeated admin-ajax.php requests with wpcq_get_quiz_result
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains:
      - 'action=wpcq_get_quiz_result'
      - 'wpcq_get_quiz_result'
  filter_legit:
    cs-uri-query|contains: 'resultID=1'
  condition: selection and not filter_legit
  timeframe: 5m
level: medium
fields:
  - c-ip
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Single legitimate quiz result view by the owner
tags:
  - attack.t1565.002
  - cve.2026.10630
  - cwe.639

YARA Rule

rule WP_Courses_LMS_IDOR_CVE_2026_10630 {
    meta:
        author = "Valtersit Cyber Threat Intelligence"
        description = "Detect HTTP requests targeting wp_courses_lms IDOR vulnerability CVE-2026-10630"
        date = "2026-01-01"
        cve = "CVE-2026-10630"
        cwe = "CWE-639"
    strings:
        $a1 = "action=wpcq_get_quiz_result" ascii wide nocase
        $a2 = "wpcq_get_quiz_result" ascii wide nocase
        $b1 = "resultID=" ascii wide nocase
        $b2 = "wpc_nonce=" ascii wide nocase
    condition:
        uint16(0) == 0x3C21 or uint16(0) == 0x3C48 or
        any of ($a*) and any of ($b*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"WP Courses LMS IDOR Quiz Result Enumeration (CVE-2026-10630)"; flow:established,to_server; content:"admin-ajax.php"; http_uri; nocase; content:"action=wpcq_get_quiz_result"; http_uri; nocase; content:"resultID="; http_uri; nocase; threshold:type both, track by_src, count 20, seconds 60; reference:cve,2026-10630; reference:cwe,639; classtype:attempted-user; sid:60310630; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [network where dns.question.name : "*" and http.request.uri contains "admin-ajax.php" and http.request.body contains "action=wpcq_get_quiz_result" and http.request.body regex~ "resultID=[0-9]{1,6}"]
  | ...
  [network where http.request.uri contains "admin-ajax.php" and http.request.body contains "wpcq_get_quiz_result" and http.request.body regex~ "resultID=[0-9]{1,6}" and http.response.status_code == 200]

Note: EQL does not easily support regex on body fields in all versions. Alternative:

any where process.name == "httpd" and http.request.uri contains "admin-ajax.php" and http.request.body contains "wpcq_get_quiz_result" and http.request.body contains "resultID="

Splunk SPL Query

index=web sourcetype=access_combined
| where like(_raw, "%admin-ajax.php%") AND like(_raw, "%wpcq_get_quiz_result%")
| rex field=_raw "resultID=(?<resultID>\d+)"
| stats count min(_time) max(_time) by src_ip resultID uri
| where count > 15 AND like(uri, "%admin-ajax.php%")
| table _time src_ip uri resultID count
| sort - count

Wazuh OSSEC Rule

<group name="wordpress,idorexploit">
  <rule id="100630" level="10" frequency="15" timeframe="60">
    <if_sid>31122</if_sid>
    <match>admin-ajax.php</match>
    <regex>action=wpcq_get_quiz_result</regex>
    <description>Possible IDOR enumeration for wpcq_get_quiz_result (CVE-2026-10630)</description>
    <group>web_application_attack,idor</group>
    <mitre>
      <id>T1565.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED) — No patch evidence found from any tracked source. The vendor has not released a fixed version.

Immediate Mitigations:

1. Restrict Access: Disable the wpcq_get_quiz_result AJAX action for all users except site administrators. This can be done via a custom mu-plugin or function that hooks into the AJAX action and verifies current_user_can('administrator') before allowing the response.
2. Disable AJAX Quiz Result Retrieval: If the quiz result review functionality is not essential, block the action entirely using an .htaccess rule or security plugin (e.g., Wordfence, iThemes Security) to deny requests containing action=wpcq_get_quiz_result.
3. Harden User Registration: If user registration is open, restrict new registrations to require admin approval, reducing the pool of potential attackers.
4. Monitor Logs: Actively monitor web server access logs for patterns of high-frequency requests to admin-ajax.php with wpcq_get_quiz_result and varying resultID values.

Patch/Upgrade Steps:

1. Check the WP Courses LMS plugin page on wordpress.org and the vendor's website for any new version > 3.2.29.
2. If a patched version is released, update the plugin immediately.
3. If no patched version exists, consider replacing the plugin with an alternative LMS solution that properly implements authorization checks on all AJAX endpoints.

Long-Term Hardening:

1. Implement a site-wide security policy that all AJAX endpoints in custom or third-party plugins include explicit authorization checks (capability or ownership verification) rather than relying on nonces.
2. Conduct a code audit of all active plugins for IDOR patterns, focusing on AJAX handlers that accept numeric IDs.
3. Deploy a WAF (e.g., Cloudflare, AWS WAF, ModSecurity) with rules to rate-limit and flag requests to admin-ajax.php with sequential ID patterns.
4. Subscribe to the plugin vendor's security advisories and monitor NVD and CISA KEV for updates.
5. Consider implementing a web application firewall rule that inspects for multiple resultID values in quick succession from the same source IP.

References

1. NVD Entry — CVE-2026-10630: https://nvd.nist.gov/vuln/detail/CVE-2026-10630 (official CVE record, CVSS 4.3, CWE-639)
2. WordPress Plugin Repository — WP Courses LMS: https://wordpress.org/plugins/wp-courses-lms/ (to check for patched versions)
3. CWE-639 — Insecure Direct Object Reference: https://cwe.mitre.org/data/definitions/639.html (vulnerability class reference)
4. OWASP IDOR Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html (mitigation guidance)
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE not listed — no known exploit in the wild as of analysis date)

Exploit-in-the-Wild Evidence: None reported. No CISA KEV inclusion, no public PoC, and no known threat actor campaigns leveraging this CVE as of the analysis date. EPSS score has not yet been assigned by FIRST.org.