What is the CVSS score of CVE-2026-9341?

CVE-2026-9341 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Academy LMS CVE-2026-9341

EUVD-2026-43658 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-14 Wordfence

GHSA-jvgv-xrf5-mp7h

WordPress Authentication Bypass Academy Lms Wordpress Plugin Kodezen

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.4 MEDIUM

C:L added over official vector because get_lesson_note explicitly enables reading private notes; all other metrics align with PR:L subscriber requirement and network delivery.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 12:01 vuln.today

CVE Published

Jul 14, 2026 - 11:30 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Academy LMS - WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.0 via the 'save_lesson_note', 'get_lesson_note', and 'complete_lesson_video' AJAX handlers due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read, overwrite, or delete the private lesson notes of any other user (including administrators), and to falsify lesson-completion progress for arbitrary users.

AnalysisAI

Insecure Direct Object Reference in the Academy LMS WordPress plugin (all versions through 3.8.0) allows authenticated attackers with Subscriber-level access to read, overwrite, or delete the private lesson notes of any user - including administrators - and to falsify lesson-completion records for arbitrary accounts. Three AJAX handlers (save_lesson_note, get_lesson_note, complete_lesson_video) perform no ownership validation on a user-controlled key, making cross-user data manipulation trivially achievable by any registered site user. No public exploit identified at time of analysis, but the attack surface is fully described via Wordfence's public threat-intelligence entry and source-level code references.

Technical ContextAI

The affected product is the Kodezen Academy LMS WordPress plugin (CPE: cpe:2.3:a:kodezen:academy_lms:*:*:*:*:*:*:*:*), an eLearning management system built on WordPress's AJAX infrastructure. The vulnerability class is CWE-639 (Authorization Through User-Controlled Key): the plugin exposes three AJAX handlers - save_lesson_note, get_lesson_note, and complete_lesson_video - that accept a user-supplied key (likely a user ID or note ID) to identify the target resource. The abstract AJAX handler base class (abstract-ajax-handler.php:L46) authenticates that a session exists but does not verify that the authenticated user is the owner of the referenced resource, creating a broken object-level authorization (BOLA/IDOR) condition. Source code for the vulnerable handlers is publicly visible at the referenced Trac browser URLs for the 3.7.4 tag (lesson.php:L253, L258, L300), and a corrective changeset (3573111) has been committed to the plugin repository.

RemediationAI

An upstream fix has been committed to the WordPress plugin repository as changeset 3573111 (https://plugins.trac.wordpress.org/changeset/3573111/); users should update the Academy LMS plugin to the first release beyond 3.8.0 as soon as it becomes available through the WordPress plugin dashboard, since the exact patched release version is not independently confirmed from the provided data - verify the current latest version in the WordPress Plugin Directory before updating. As a compensating control while awaiting the update, site administrators can temporarily restrict subscriber-level user registration if open registration is enabled, which removes the most accessible attacker entry point; note this may disrupt legitimate student enrollment workflows. Alternatively, a WAF rule targeting the AJAX actions save_lesson_note, get_lesson_note, and complete_lesson_video that enforces user-ID consistency between session and request payload can mitigate exploitation without disabling the plugin entirely, though this requires WAF capability and may interfere with legitimate use if not carefully tuned.