EUVD-2026-41250
GHSA-p8p5-g7rx-q44c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable REST endpoint requires no authentication or interaction; impact is solely low confidentiality disclosure of course structure with no integrity or availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Academy LMS - WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.8.1. This is due to the '/topics' REST API endpoint being registered with a permission callback set to '__return_true', allowing unauthenticated access to course curriculum data without verifying the course's post status or user enrollment. This makes it possible for unauthenticated attackers to access detailed curriculum information for private, draft, scheduled, or password-protected courses by enumerating course IDs.
AnalysisAI
Unauthenticated curriculum exposure in the Academy LMS WordPress plugin (versions ≤ 3.8.1) allows any internet user to retrieve detailed topic and lesson structures from courses explicitly protected by private, draft, scheduled, or password-protected post statuses. The root cause is the plugin's '/topics' REST API endpoint registering with '__return_true' as its permission callback, entirely bypassing WordPress's built-in post visibility and enrollment enforcement. No exploit code has been publicly identified and the vulnerability is not listed in CISA KEV, but the zero-complexity network vector makes automated course ID enumeration trivially scriptable with standard HTTP tools.
Technical ContextAI
The Academy LMS plugin implements a custom WordPress REST API route at '/topics' within 'includes/api/course.php' (lines 50 and 77). WordPress REST API routes accept a 'permission_callback' parameter to enforce access control; the plugin assigns '__return_true' - a WordPress core function that unconditionally returns boolean true - which causes WordPress to skip all authorization checks for that route. The curriculum retrieval logic in 'includes/traits/courses.php' (line 1514) then processes the caller-supplied course ID without verifying the course's post status (private, draft, scheduled, password-protected) or whether the requesting user is enrolled. This is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key) pattern: the attacker supplies a user-controlled object reference (course ID integer), and the server resolves it to a protected resource without confirming entitlement. The affected CPE is the 'academy' plugin for WordPress up to version 3.8.1 as documented in the WordPress plugin trac repository.
RemediationAI
Update the Academy LMS plugin to the first release above version 3.8.1 that incorporates changeset 3592849 from the WordPress plugin trac repository - verify the exact version number in the plugin's changelog before updating, as the precise released patch version is not confirmed in the available data. As a compensating control while awaiting a confirmed patched release, deploy a web application firewall rule (Wordfence or equivalent) to block unauthenticated GET requests matching the '/wp-json/*/topics' path pattern; note this may interfere with legitimate unauthenticated course browsing if the endpoint is used by the plugin's frontend for enrolled users, so test in staging first. A more aggressive but broader mitigation is adding a 'rest_authentication_errors' filter to require authentication for all WordPress REST API requests, though this will break any other plugin relying on public REST endpoints and should be evaluated carefully. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b84ae3e0-de4f-41d6-8944-fadaf6fdcf79 should be monitored for confirmation of the patched release version.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today