Academy LMS Plugin Authorization and Privilege Flaws

Authorization bypass in the Academy LMS - AI Course Builder, Quizzes, Certificates & eLearning WordPress plugin (all versions up to and including 4.0.3) allows any user who holds an instructor role for at least one course to permanently delete lesson comments and their replies belonging to courses they do not instruct, including comments authored by administrators. Exploitation requires an authenticated account with instructor-level access (CVSS PR:L), and the attacker supplies their own valid course_id to pass the plugin's flawed instructor check while targeting comment IDs from other courses; the abuse results in irreversible content destruction (integrity impact High, confidentiality and availability unaffected per the assessed vector). No public exploit code has been identified at time of analysis, the issue is not listed as confirmed actively exploited (CISA KEV), and the assessed severity is moderate (CVSS 6.5) rather than an emergency, primarily because the instructor-account prerequisite confines the threat to semi-trusted internal users.

Authenticated privilege escalation in the Academy LMS WordPress plugin through version 4.0.3 lets a user with the academy_guardian role or higher assign the academy_student role to any existing WordPress account, including their own, via the guardian add_child REST API. The flaw stems from add_role('academy_student') executing before Store::link() validates the guardian-ward relationship and not rolling back on WP_Error, so even self-links rejected by Store::link() leave the role grant in place. This yields Contributor-equivalent edit_posts unconditionally and Author-equivalent upload_files only when the student file-upload setting is enabled; CVSS is 5.4 and no public exploit has been identified at time of analysis.