Academy LMS EUVD-2026-96027

Exploitation requires an authenticated WordPress account that is registered as an Academy LMS instructor for at least one course (custom-level access and above per the advisory); anonymous or subscriber-only users cannot exploit it. The attacker must know or enumerate comment IDs belonging to courses they do not instruct, and supplies their own legitimate course_id to pass the flawed instructor check. No special non-default plugin configuration is required beyond having the Academy LMS plugin active (versions up to and including 4.0.3) with instructor-role functionality in use. The limiting factor is the instructor-account prerequisite (PR:L), which confines the threat to semi-trusted internal users rather than the open internet; no user interaction from the victim is needed.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) is driven entirely by an Integrity impact (data deletion) with no confidentiality or availability loss. The network vector and low attack complexity are real, but PR:L is the key limiter: exploitation requires an authenticated account that is registered as an Academy instructor for at least one course, which meaningfully narrows the attacker pool to existing, somewhat-trusted users rather than anonymous internet attackers. No EPSS score, KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals are internally consistent (a low-glamour data-tampering flaw unlikely to see mass exploitation). The impact is bounded: an attacker can permanently delete lesson comments/replies belonging to other courses, which is a data-integrity and content-moderation problem, not code execution or data theft. Note one conceptual tension to verify: the primary impact is permanent deletion of records, which some analysts would model as an Availability impact (A:H) rather than Integrity (I:H); Wordfence scored it as I:H and that is defensible since it is unauthorized modification of stored data, but defenders should understand the real effect is irreversible content loss.

An attacker who holds any Academy LMS instructor account (instructor on even a single course) sends a crafted AJAX request to the vulnerable comment-deletion endpoint, supplying their own course_id to satisfy the instructor authorization check while referencing a comment ID that belongs to a completely different course they do not teach. Because the plugin verifies instructor status against the supplied course rather than the comment's owning course, the deletion succeeds and permanently removes comments and replies authored by other users, including administrators. No public exploit code is identified in the provided data, and the low attack complexity means a valid instructor could script bulk deletions easily.