What is the CVSS score of CVE-2026-12376?

CVE-2026-12376 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-12376?

Yes, a public proof-of-concept exploit is available for CVE-2026-12376. Prioritise patching immediately. EPSS: 0.1%.

Academy LMS CVE-2026-12376

EUVD-2026-51435 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-31 WPScan

GHSA-fhwq-jmfm-9jmv

WordPress Authentication Bypass Academy Lms Unknown

4.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible endpoint, low complexity; PR:L reflects mandatory subscriber authentication and course enrollment; read-only PII exposure justifies C:L with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 20:37 vuln.today

CVSS changed

Jul 31, 2026 - 18:37 NVD

4.3 (MEDIUM)

CVE Published

Jul 31, 2026 - 06:00 cve.org

MEDIUM 4.3

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above (enrolled in any single course) to read every user's quiz attempts across the whole site, including personal data such as IP addresses, names, registration dates and quiz results.

AnalysisAI

Broken Object Level Authorization in the Academy LMS WordPress plugin through 3.8.2 exposes every user's quiz attempt records - including IP addresses, full names, registration dates, and quiz results - to any authenticated subscriber-level user who is enrolled in at least one course. The flaw stems from missing ownership checks on quiz attempt record retrieval endpoints (CWE-639), enabling horizontal privilege escalation across the entire site's student population. A publicly available proof-of-concept exists per WPScan; exploitation probability remains low (EPSS 0.13%, 3rd percentile) with no confirmed active exploitation in CISA KEV.

Technical ContextAI

Academy LMS is a WordPress learning management system plugin (CPE: cpe:2.3:a:unknown:academy_lms:*:*:*:*:*:*:*:*). The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin's quiz attempt retrieval logic accepts a user-controlled record identifier (attempt ID or user ID) without verifying that the requesting user owns or has administrative rights to that record. In WordPress LMS contexts, quiz attempt records are stored as post meta or custom table rows associated with a specific user. The lack of an ownership check means any subscriber-level user - the lowest authenticated WordPress role - who is enrolled in at least one course can enumerate and retrieve attempt records belonging to any other site user, including instructors and administrators.

RemediationAI

No vendor-released patched version has been identified at time of analysis - the affected range is listed as all versions through 3.8.2 with no confirmed fix version. Site operators should monitor the Academy LMS plugin changelog and the WordPress plugin repository for an updated release and apply it immediately upon availability. As a compensating control, restrict course enrollment to trusted users only and disable public or open enrollment to raise the bar for obtaining the required subscriber-level authenticated access. Additionally, consider temporarily disabling the plugin or restricting access to quiz attempt API endpoints via WAF rules if the platform does not currently require active quiz functionality. Note that disabling the plugin will also disable all LMS features, so this trade-off must be weighed against site operations. Data protection officers should assess whether the unauthorized exposure of IP addresses and quiz results constitutes a reportable breach under applicable regulations (e.g., GDPR Article 33). Reference: https://wpscan.com/vulnerability/8cdd6ab6-d523-4406-a0ef-d9b3b27e10c8/.