Academy LMS EUVD-2026-94177

Exploitation requires an authenticated account that already has access to at least one course on the site - the description explicitly scopes this to 'any authenticated user with access to a single course, such as an enrolled student.' The concrete prerequisite is a valid session plus enrollment in one course; the attacker then references quiz question identifiers belonging to courses they are not enrolled in. Limiting factors that reduce real-world risk: authentication is mandatory (PR:L, not PR:N), no exploitation against anonymous visitors is possible, impact is confined to reading quiz answer options (no write/modify, no account or site takeover), and each disclosure is tied to a live authenticated session, making the attack non-automatable at scale (SSVC Automatable: no). Affected deployments are Academy LMS versions 0 up to but not including 4.0.0.

This is a genuine but low-priority vulnerability, not a high-severity emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3 Medium) is internally consistent with the description: network-reachable, low complexity, but requiring authentication (PR:L) and yielding only limited confidentiality impact (C:L) with no integrity or availability effect. The SSVC decision framework agrees and reinforces the low urgency: Exploitation 'none' (no observed active exploitation), Automatable 'no' (requires a valid per-victim authenticated session and course enrollment, so it does not scale to mass automated abuse), and Technical Impact 'partial.' A public exploit exists (WPScan), which raises exploitability relative to a theoretical bug, but POC availability is NOT active exploitation and must not be conflated - this CVE is not in CISA KEV. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in and should be checked separately. Signals are consistent rather than conflicting: every source points to an authenticated, low-impact information-disclosure (IDOR) issue affecting only the confidentiality of quiz answer options. Bottom line - patch in normal cycles; this is not a drop-everything issue.

An attacker enrolls in (or already has access to) any single course on an Academy LMS site, then authenticates and issues requests referencing quiz question identifiers from courses they are not enrolled in, receiving those questions' answer options in response. A public proof-of-concept is available via WPScan, lowering the barrier to reproduction, though exploitation still yields only leaked quiz answers rather than site compromise.