EUVD-2026-52183
GHSA-9988-37r6-j7j6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable REST API (AV:N/AC:L), subscriber account required (PR:L), full lesson content readable (C:H), no write or availability impact (I:N/A:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student (Subscriber-level) account to disclose the content of arbitrary lessons, including lessons of paid courses they are not enrolled in and unpublished (draft, pending, private) lessons.
AnalysisAI
Unauthorized lesson content disclosure in Academy LMS WordPress plugin before 3.8.3 allows any subscriber-level authenticated user to read arbitrary lesson content via the REST API - including lessons from paid courses they have not purchased and lessons in unpublished states (draft, pending, private). The root cause is a complete absence of enrollment and publication-status validation in the single-lesson REST API endpoint. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.13% (3rd percentile) and SSVC classification as non-automatable indicate limited observed exploitation activity at the time of analysis.
Technical ContextAI
Academy LMS is a WordPress learning management system plugin that exposes course and lesson data through WordPress REST API endpoints. The vulnerable endpoint - responsible for returning a single lesson object - fails to implement the two authorization checks that should gate access: (1) whether the requesting user is enrolled in the parent course, and (2) whether the lesson post has a published status. This maps directly to CWE-284 (Improper Access Control), where authorization logic is simply absent rather than misconfigured. WordPress post statuses include draft, pending, and private, all of which should be invisible to non-privileged users; the plugin bypasses these guardrails entirely. The affected product range is captured in CPE cpe:2.3:a:unknown:academy_lms:*:*:*:*:*:*:*:* (note: NVD has not yet assigned a normalized vendor identifier). The plugin's REST API likely retrieves lesson post data directly without consulting WooCommerce enrollment records or equivalent LMS enrollment tables.
RemediationAI
Update the Academy LMS WordPress plugin to version 3.8.3 or later, which introduces the missing enrollment and publication-status validation in the REST API lesson endpoint (vendor-released patch confirmed by WPScan advisory at https://wpscan.com/vulnerability/eec480b0-67af-4642-b6b3-cba095394286/). Prior to patching, administrators can deploy a compensating control by blocking REST API access for subscriber-level users using a plugin such as 'Disable REST API' or by implementing a custom WordPress filter on rest_authentication_errors - note that this may break legitimate frontend LMS functionality that depends on the API and should be tested before deployment. A more targeted approach is to block the specific lesson retrieval endpoint pattern (e.g., /wp-json/academy/v*/lessons/) via WAF rules or .htaccess, which limits disruption to non-lesson API calls. If the site does not allow open subscriber self-registration, the attack surface is further limited to existing account holders. The plugin update is the only complete remediation.
More in Academy Lms
View allA vulnerability was found in Academy LMS 6.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploit
Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to t
Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attack
A vulnerability was found in Academy LMS 6.2 on Windows. Rated medium severity (CVSS 6.1), this vulnerability is remotel
Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability. Rated medium severit
A vulnerability has been found in Academy LMS 6.0 and classified as problematic. Rated medium severity (CVSS 6.1), this
Academy LMS WordPress plugin versions prior to 3.8.1 exposes an Insecure Direct Object Reference (IDOR) flaw across mult
The Academy LMS - eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege esc
Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.0.4. Rated high severity (CVSS 8.8), this
Missing Authorization vulnerability in Academy LMS academy.9.16. Rated high severity (CVSS 8.8), this vulnerability is r
Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel. Rated med
Broken Object Level Authorization in the Academy LMS WordPress plugin through 3.8.2 exposes every user's quiz attempt re
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today