What is the CVSS score of EUVD-2026-46163?

EUVD-2026-46163 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-46163?

Yes, a public proof-of-concept exploit is available for EUVD-2026-46163. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for EUVD-2026-46163?

Yes, a patch is available for EUVD-2026-46163. Update the affected software to the latest version immediately.

Academy LMS EUVD-2026-46163

| CVE-2026-14184 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-21 WPScan

GHSA-5p7v-x4q4-6428

WordPress Authentication Bypass Academy Lms Unknown

5.4

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable AJAX endpoint with no special conditions; PR:L because a subscriber account is the minimum prerequisite; impact bounded to lesson data confidentiality and integrity only, no availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 16:30 vuln.today

CVSS changed

Jul 21, 2026 - 16:22 NVD

5.4 (MEDIUM)

Patch available

Jul 21, 2026 - 08:02 EUVD

CVE Published

Jul 21, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 21, 2026 - 06:00 cve.org

MEDIUM 5.4

DescriptionCVE.org

The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as completed.

AnalysisAI

Academy LMS WordPress plugin versions prior to 3.8.1 exposes an Insecure Direct Object Reference (IDOR) flaw across multiple lesson AJAX handlers, allowing any subscriber-level authenticated user to read and overwrite other users' lesson notes and fraudulently mark course content as completed on their behalf. The vulnerability affects all Academy LMS installations running an unpatched version and is worsened by a publicly available exploit published via WPScan, though no active exploitation has been confirmed through CISA KEV. In environments where course completion carries compliance, certification, or audit significance, the integrity impact exceeds what the Medium CVSS score alone conveys.

Technical ContextAI

The affected component is the Academy LMS WordPress plugin (CPE: cpe:2.3:a:unknown:academy_lms:*:*:*:*:*:*:*:*), a Learning Management System plugin designed for WordPress-based e-learning platforms. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR class vulnerability in which server-side AJAX handlers accept a user-supplied user identifier as input but perform no verification that the supplied identifier corresponds to the authenticated requesting user. This constitutes a broken object-level authorization (BOLA) failure - a category consistently ranked among the most prevalent API and web application security weaknesses. The attack surface is the WordPress AJAX endpoint (admin-ajax.php), which is reachable over the network by any authenticated user. Because WordPress subscriber is the lowest authenticated role, the privilege barrier to exploitation is minimal.

RemediationAI

The primary and strongly recommended fix is to upgrade the Academy LMS WordPress plugin to version 3.8.1 or later, in which ownership verification has been introduced to the affected lesson AJAX handlers. Administrators should apply this update immediately via the WordPress admin dashboard under Plugins > Installed Plugins > Update, or by downloading the patched release directly. The vendor-confirmed fix is referenced at https://wpscan.com/vulnerability/56a5b91b-1e1a-429d-b9e9-a1a107183124/. If immediate patching is operationally blocked, a partial compensating control is to disable open WordPress subscriber registration, ensuring that only trusted, vetted users hold any authenticated account on the affected site; this raises the attacker's access prerequisite but does not close the vulnerability and risks legitimate user lockout. Deploying a Web Application Firewall rule to detect AJAX requests where the supplied user ID does not match the session's authenticated user ID may further reduce exposure but is not a reliable substitute for patching due to encoding and parameter variation.