Academy LMS CVE-2026-9341

Exploitation requires a valid WordPress user account at Subscriber level or above on the target site - unauthenticated exploitation is not possible per the CVSS PR:L metric. The site must be running Academy LMS plugin version 3.8.0 or earlier. The vulnerable AJAX endpoints (save_lesson_note, get_lesson_note, complete_lesson_video) must be reachable, which is the default state for any WordPress installation with the plugin active. Sites that permit open user registration (common for public eLearning deployments) effectively allow any internet user to satisfy the authentication prerequisite by self-registering. Exploitation is limited to the LMS data layer: attackers cannot escalate privileges, execute code, or access WordPress core data outside of lesson notes and completion records. The attack does not require any specific course enrollment status or administrative configuration beyond plugin installation.

The official CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately captures the low-complexity, network-accessible nature of the flaw but appears to undercount the confidentiality dimension: the CVE description explicitly states that get_lesson_note enables reading other users' private notes, which corresponds to C:L rather than C:N - this discrepancy should be verified against the vendor's scoring rationale. No EPSS score was provided; KEV status is negative, meaning CISA has not confirmed active exploitation. No standalone POC exploit was cited, though the combination of Wordfence's public write-up and exposed source code references substantially lowers the barrier for weaponization. Real-world risk is bounded by the subscriber-level authentication prerequisite: an attacker must hold a valid account on the target WordPress site. Sites using Academy LMS for open self-registration (a common eLearning pattern) effectively expand the attacker pool to any internet user who can register. Impact is limited to the LMS data plane - lesson notes and completion records - with no code execution or privileged account takeover implied.

An attacker registers a free subscriber account on a WordPress site running Academy LMS 3.8.0 or earlier, then issues a crafted authenticated AJAX POST request to wp-admin/admin-ajax.php with action=get_lesson_note and a target user's ID or note ID substituted in the user-controlled key parameter, successfully retrieving that user's private lesson notes. The same technique applied to save_lesson_note or complete_lesson_video allows overwriting notes or falsifying the completion status of any course lesson for any enrolled user, including administrators. No public exploit code was identified at time of analysis, but the Wordfence write-up and Trac source references provide sufficient detail to construct a proof-of-concept.