Academy LMS EUVD-2026-52183

Exploitation requires a valid WordPress subscriber-level (or higher) account on the target site, as confirmed by CVSS PR:L - unauthenticated exploitation is not possible. The attacker must also be able to enumerate or guess lesson post IDs, which is facilitated by WordPress's sequential integer post ID scheme. The vulnerability is present on any site running Academy LMS versions prior to 3.8.3 with the plugin active and REST API enabled (the WordPress REST API is enabled by default). Exploitation is limited by: the requirement for at least a subscriber account (sites that disable open user registration reduce the external attacker pool to existing account holders); the non-automatable nature of the attack per SSVC (bulk enumeration requires iterative requests rather than a single exploit payload); and the impact being confined to content confidentiality only - no privilege escalation, code execution, or data modification is possible.

The CVSS 6.5 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately reflects the nature of this flaw: network-reachable, low complexity, requires only a subscriber account, and results in full confidentiality loss for lesson content. However, real-world risk is substantially lower than the C:H rating might imply in isolation. EPSS at 0.13% (3rd percentile) indicates the vulnerability has seen minimal exploitation activity relative to the broader CVE population. SSVC reinforces this: exploitation status is 'poc' (not active), the attack is not automatable (each lesson requires targeted ID-based requests), and technical impact is partial. There is no CISA KEV listing. The business impact is primarily financial and reputational - paid course content can be accessed without payment - rather than a system compromise. The PR:L requirement means free account registration must be possible on the target site for an unauthenticated threat actor to exploit this; sites that restrict self-registration are additionally protected. No integrity or availability impact exists; this is a pure disclosure flaw.

An attacker registers a free subscriber account on an Academy LMS-powered e-learning site and then issues REST API GET requests to the single-lesson endpoint, iterating through sequential WordPress post IDs to enumerate lesson content. Because WordPress post IDs are sequential and predictable, the attacker can systematically extract paid course material - such as video transcripts, downloadable files, or structured lesson text - without purchasing enrollment. A publicly available proof-of-concept (documented by WPScan) provides the request structure, making this accessible to low-sophistication threat actors targeting sites with valuable proprietary course content.