Academy LMS CVE-2026-104022

The attacker must be authenticated and hold the plugin-specific academy_guardian role or higher (PR:L) - this is the primary limiting factor, since the guardian role is not granted by default to ordinary registrants. Exploitation is performed through the guardian add_child REST API endpoint by supplying the email parameter of any existing WordPress account; the flaw triggers because add_role('academy_student') runs before Store::link() validates the guardian-ward relationship and is not rolled back on WP_Error, so even a self-link that Store::link() rejects (when the supplied email resolves to the attacker's own user ID via email_exists()) still leaves the role grant in place. Escalation to edit_posts (Contributor-equivalent) occurs unconditionally on success; the additional upload_files (Author-equivalent) capability is only obtained when the plugin's student file-upload setting is enabled - a non-default configuration dependency that limits the higher-impact outcome.

This is an authenticated privilege-escalation flaw (CWE-269) with a moderate CVSS of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). The network vector and low attack complexity are offset by the PR:L requirement: the attacker must already hold the plugin-specific academy_guardian role (or higher), which materially shrinks the attacker population to users already granted guardian privileges on the site. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation-probability signals are absent rather than low - this is a data gap, not evidence of safety. No public exploit identified at time of analysis, and the vulnerability is not in CISA KEV, so there is no confirmed active exploitation. The practical ceiling of the attack is also limited: successful escalation yields academy_student (Contributor-equivalent edit_posts, and Author-equivalent upload_files only when the student file-upload setting is enabled) - not administrator - so this is a stepping-stone/foothold issue rather than a site-takeover primitive. Net: a legitimate but medium-priority patch item; the bounded impact (I:L, C:L, A:N) and the guardian-role precondition argue against emergency treatment, while the network-reachable, low-complexity, self-service nature (an attacker can elevate their own account) argues against ignoring it on sites that hand out the guardian role.

An authenticated user holding the academy_guardian role calls the plugin's guardian add_child REST endpoint and supplies the email address of an existing WordPress account (including their own). The add_role('academy_student') write executes before Store::link() validates the guardian-ward relationship and is never rolled back when that validation returns WP_Error, so the target account permanently gains academy_student capabilities. No public exploit code is known, but the vector is network-reachable with low complexity (AC:L) and no user interaction (UI:N).