Academy LMS CVE-2026-14184

Exploitation requires the attacker to hold at minimum a subscriber-level authenticated WordPress account on the target site - unauthenticated attackers cannot exploit this flaw. The target site must have the Academy LMS plugin installed and active in a version prior to 3.8.1. The attacker must supply a valid user identifier belonging to another registered learner on the same WordPress instance, requiring either enumeration of WordPress user IDs (a commonly trivial task on default WordPress configurations) or prior knowledge of a target's account. The affected lesson AJAX handlers must be reachable over the network via the standard WordPress admin-ajax.php endpoint. Key limiting factors: the mandatory authenticated access requirement means sites that disable or tightly restrict subscriber registration have a substantially reduced attack surface; the impact is horizontally scoped (user-to-user, same privilege level) with no vertical escalation to administrator; and no system-level compromise, credential exposure, or remote code execution is possible through this vulnerability alone.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) scores 5.4 Medium, reflecting network accessibility with low attack complexity and low privilege requirements, but bounded confidentiality and integrity impact. The C:L and I:L ratings are appropriate: exposure is limited to lesson notes (not credentials, PII, or financial data) and integrity impact is confined to falsifying lesson completion state rather than achieving code execution or persistent system compromise. Critically, a publicly available exploit exists via WPScan, meaning automated or scripted abuse requires no independent exploit development. However, this vulnerability is not listed in CISA KEV, and no EPSS score was provided, so widespread in-the-wild exploitation is not confirmed. Real-world risk is elevated above the raw score in contexts where Academy LMS is used for compliance training, professional certifications, or auditable course completion records, where fraudulent completion marking could constitute regulatory or contractual fraud. Sites with open subscriber registration face a materially higher threat surface.

An attacker registers a free subscriber-level account on a WordPress site running an unpatched Academy LMS installation - or leverages an existing account on a site with open registration. Using the publicly available WPScan exploit reference, the attacker sends crafted AJAX requests to the vulnerable lesson handlers, supplying the user ID of a targeted learner enrolled in the same LMS. The attacker reads the victim's private lesson notes and marks course modules as complete on the victim's behalf, potentially falsifying a compliance certification record or undermining a regulated training audit trail.