Academy LMS CVE-2026-104049

Exploitation requires that the site allow self-service student registration (so the attacker can obtain the low-privileged account the CVSS PR:L reflects) and that it run Academy LMS prior to version 4.0.0 exposing the affected REST API route. The attacker must send requests to that specific REST route referencing lesson objects belonging to courses they are not enrolled in. Limiting factors that reduce real-world risk: a valid (if low-privileged) authenticated student account is required, impact is confined to confidentiality of lesson content (no data modification or site disruption), and sites that disable open student registration materially raise the barrier to entry.

This is a moderate-severity information-disclosure (IDOR / CWE-639) flaw whose signals are internally consistent and point to a real-but-bounded issue rather than an urgent emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3 Medium) indicates a network-reachable, low-complexity attack that nonetheless requires a low-privileged (student) account and yields only limited confidentiality impact with no integrity or availability loss - consistent with the description of reading lesson content. CISA's SSVC framework aligns with this lower urgency: Exploitation=none (no observed in-the-wild activity), Automatable=no, Technical Impact=partial. The key tension is that publicly available exploit code (POC) exists AND the issue is trivially reachable by any self-registered student, yet it is NOT in CISA KEV and SSVC reports no observed exploitation; POC availability is a distinct signal from active exploitation and should not be conflated. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in - STATE EXPLICITLY: EPSS data is missing. Net assessment: patch on a normal-to-prioritized cycle (confidentiality-only, authenticated, no KEV) rather than treating as a drop-everything emergency, but the low barrier to entry (self-registration + public POC) warrants prompt attention for sites exposing paid/private course content.

An attacker self-registers a free student account on a WordPress site running Academy LMS before 4.0.0, then calls the vulnerable REST API route with lesson identifiers for courses they never purchased or enrolled in. Because the endpoint does not verify enrollment or object ownership, the server returns the full content of those paid or private lessons. Public exploit code is already available (via WPScan), lowering the effort required, though the low-complexity network attack still requires a valid low-privileged student account.