Academy LMS CVE-2026-12376

Exploitation requires two concrete preconditions: (1) the attacker must hold a valid WordPress account at subscriber level or above on the target site, and (2) that account must be enrolled in at least one course within the Academy LMS plugin. Open or free enrollment lowers the barrier to nearly unauthenticated access. Exploitation is limited by the requirement to be a registered, enrolled user - unauthenticated visitors cannot exploit this flaw. No specific non-default configuration is required; the vulnerability is present in the default plugin installation on any WordPress site running Academy LMS ≤ 3.8.2 with at least one course available for enrollment. Automating across many sites is constrained by the enrollment prerequisite (SSVC: Automatable: no), making mass exploitation impractical. The impact is read-only (C:L, I:N, A:N) - no write or destructive capability is exposed.

The CVSS base score of 4.3 (Medium) accurately reflects the constrained impact: confidentiality-only, no integrity or availability component, and limited data exposure scope (C:L). The PR:L vector confirms exploitation requires authentication and course enrollment, which meaningfully limits the attacker pool to registered students on the platform. EPSS at 0.13% (3rd percentile) signals very low exploitation probability in the wild despite the public WPScan PoC, consistent with SSVC's 'automatable: no' designation - mass exploitation is not viable because enrolling in a course may require approval or payment. SSVC technical impact is 'partial', aligning with the read-only PII exposure. There is no KEV listing. The primary real-world risk is a privacy/compliance incident (GDPR, FERPA) on educational platforms rather than a system compromise: exposed data includes names, IPs, and academic performance records. For sites hosting sensitive educational data or operating under data protection regulations, the regulatory impact may exceed what the CVSS score implies.

An attacker registers as a student on the target WordPress site and enrolls in any single available course, gaining subscriber-level access. Using the publicly available WPScan PoC, the attacker iterates over quiz attempt IDs or user IDs in the plugin's attempt-retrieval endpoint - receiving name, IP address, registration date, and quiz results for every student on the platform with no ownership validation. The harvested PII can be used for targeted phishing, credential stuffing with registration data, or sold, while quiz results may expose academic performance information with regulatory implications.