EUVD-2026-46163
GHSA-5p7v-x4q4-6428
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable AJAX endpoint with no special conditions; PR:L because a subscriber account is the minimum prerequisite; impact bounded to lesson data confidentiality and integrity only, no availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as completed.
AnalysisAI
Academy LMS WordPress plugin versions prior to 3.8.1 exposes an Insecure Direct Object Reference (IDOR) flaw across multiple lesson AJAX handlers, allowing any subscriber-level authenticated user to read and overwrite other users' lesson notes and fraudulently mark course content as completed on their behalf. The vulnerability affects all Academy LMS installations running an unpatched version and is worsened by a publicly available exploit published via WPScan, though no active exploitation has been confirmed through CISA KEV. In environments where course completion carries compliance, certification, or audit significance, the integrity impact exceeds what the Medium CVSS score alone conveys.
Technical ContextAI
The affected component is the Academy LMS WordPress plugin (CPE: cpe:2.3:a:unknown:academy_lms:*:*:*:*:*:*:*:*), a Learning Management System plugin designed for WordPress-based e-learning platforms. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR class vulnerability in which server-side AJAX handlers accept a user-supplied user identifier as input but perform no verification that the supplied identifier corresponds to the authenticated requesting user. This constitutes a broken object-level authorization (BOLA) failure - a category consistently ranked among the most prevalent API and web application security weaknesses. The attack surface is the WordPress AJAX endpoint (admin-ajax.php), which is reachable over the network by any authenticated user. Because WordPress subscriber is the lowest authenticated role, the privilege barrier to exploitation is minimal.
RemediationAI
The primary and strongly recommended fix is to upgrade the Academy LMS WordPress plugin to version 3.8.1 or later, in which ownership verification has been introduced to the affected lesson AJAX handlers. Administrators should apply this update immediately via the WordPress admin dashboard under Plugins > Installed Plugins > Update, or by downloading the patched release directly. The vendor-confirmed fix is referenced at https://wpscan.com/vulnerability/56a5b91b-1e1a-429d-b9e9-a1a107183124/. If immediate patching is operationally blocked, a partial compensating control is to disable open WordPress subscriber registration, ensuring that only trusted, vetted users hold any authenticated account on the affected site; this raises the attacker's access prerequisite but does not close the vulnerability and risks legitimate user lockout. Deploying a Web Application Firewall rule to detect AJAX requests where the supplied user ID does not match the session's authenticated user ID may further reduce exposure but is not a reliable substitute for patching due to encoding and parameter variation.
More in Academy Lms
View allA vulnerability was found in Academy LMS 6.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploit
Unauthorized lesson content disclosure in Academy LMS WordPress plugin before 3.8.3 allows any subscriber-level authenti
Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to t
Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attack
A vulnerability was found in Academy LMS 6.2 on Windows. Rated medium severity (CVSS 6.1), this vulnerability is remotel
Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability. Rated medium severit
A vulnerability has been found in Academy LMS 6.0 and classified as problematic. Rated medium severity (CVSS 6.1), this
The Academy LMS - eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege esc
Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.0.4. Rated high severity (CVSS 8.8), this
Missing Authorization vulnerability in Academy LMS academy.9.16. Rated high severity (CVSS 8.8), this vulnerability is r
Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel. Rated med
Broken Object Level Authorization in the Academy LMS WordPress plugin through 3.8.2 exposes every user's quiz attempt re
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today