Academy Lms
Monthly
Unauthorized lesson content disclosure in Academy LMS WordPress plugin before 3.8.3 allows any subscriber-level authenticated user to read arbitrary lesson content via the REST API - including lessons from paid courses they have not purchased and lessons in unpublished states (draft, pending, private). The root cause is a complete absence of enrollment and publication-status validation in the single-lesson REST API endpoint. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.13% (3rd percentile) and SSVC classification as non-automatable indicate limited observed exploitation activity at the time of analysis.
Broken Object Level Authorization in the Academy LMS WordPress plugin through 3.8.2 exposes every user's quiz attempt records - including IP addresses, full names, registration dates, and quiz results - to any authenticated subscriber-level user who is enrolled in at least one course. The flaw stems from missing ownership checks on quiz attempt record retrieval endpoints (CWE-639), enabling horizontal privilege escalation across the entire site's student population. A publicly available proof-of-concept exists per WPScan; exploitation probability remains low (EPSS 0.13%, 3rd percentile) with no confirmed active exploitation in CISA KEV.
Academy LMS WordPress plugin versions prior to 3.8.1 exposes an Insecure Direct Object Reference (IDOR) flaw across multiple lesson AJAX handlers, allowing any subscriber-level authenticated user to read and overwrite other users' lesson notes and fraudulently mark course content as completed on their behalf. The vulnerability affects all Academy LMS installations running an unpatched version and is worsened by a publicly available exploit published via WPScan, though no active exploitation has been confirmed through CISA KEV. In environments where course completion carries compliance, certification, or audit significance, the integrity impact exceeds what the Medium CVSS score alone conveys.
Insecure Direct Object Reference in the Academy LMS WordPress plugin (all versions through 3.8.0) allows authenticated attackers with Subscriber-level access to read, overwrite, or delete the private lesson notes of any user - including administrators - and to falsify lesson-completion records for arbitrary accounts. Three AJAX handlers (save_lesson_note, get_lesson_note, complete_lesson_video) perform no ownership validation on a user-controlled key, making cross-user data manipulation trivially achievable by any registered site user. No public exploit identified at time of analysis, but the attack surface is fully described via Wordfence's public threat-intelligence entry and source-level code references.
Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the string parameter to the /academy/course_bundles/search/query endpoint. [CVSS 6.1 MEDIUM]
Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.0.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing Authorization vulnerability in Academy LMS academy.9.16. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Academy LMS academy.9.25. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Academy LMS.9.16. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Academy LMS - eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
A vulnerability was found in Academy LMS 6.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in Academy LMS 6.2 on Windows. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Academy LMS 6.0 and classified as problematic. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Creativeitem Academy LMS 5.15. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthorized lesson content disclosure in Academy LMS WordPress plugin before 3.8.3 allows any subscriber-level authenticated user to read arbitrary lesson content via the REST API - including lessons from paid courses they have not purchased and lessons in unpublished states (draft, pending, private). The root cause is a complete absence of enrollment and publication-status validation in the single-lesson REST API endpoint. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.13% (3rd percentile) and SSVC classification as non-automatable indicate limited observed exploitation activity at the time of analysis.
Broken Object Level Authorization in the Academy LMS WordPress plugin through 3.8.2 exposes every user's quiz attempt records - including IP addresses, full names, registration dates, and quiz results - to any authenticated subscriber-level user who is enrolled in at least one course. The flaw stems from missing ownership checks on quiz attempt record retrieval endpoints (CWE-639), enabling horizontal privilege escalation across the entire site's student population. A publicly available proof-of-concept exists per WPScan; exploitation probability remains low (EPSS 0.13%, 3rd percentile) with no confirmed active exploitation in CISA KEV.
Academy LMS WordPress plugin versions prior to 3.8.1 exposes an Insecure Direct Object Reference (IDOR) flaw across multiple lesson AJAX handlers, allowing any subscriber-level authenticated user to read and overwrite other users' lesson notes and fraudulently mark course content as completed on their behalf. The vulnerability affects all Academy LMS installations running an unpatched version and is worsened by a publicly available exploit published via WPScan, though no active exploitation has been confirmed through CISA KEV. In environments where course completion carries compliance, certification, or audit significance, the integrity impact exceeds what the Medium CVSS score alone conveys.
Insecure Direct Object Reference in the Academy LMS WordPress plugin (all versions through 3.8.0) allows authenticated attackers with Subscriber-level access to read, overwrite, or delete the private lesson notes of any user - including administrators - and to falsify lesson-completion records for arbitrary accounts. Three AJAX handlers (save_lesson_note, get_lesson_note, complete_lesson_video) perform no ownership validation on a user-controlled key, making cross-user data manipulation trivially achievable by any registered site user. No public exploit identified at time of analysis, but the attack surface is fully described via Wordfence's public threat-intelligence entry and source-level code references.
Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the string parameter to the /academy/course_bundles/search/query endpoint. [CVSS 6.1 MEDIUM]
Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.0.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing Authorization vulnerability in Academy LMS academy.9.16. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Academy LMS academy.9.25. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Academy LMS.9.16. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Academy LMS - eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
A vulnerability was found in Academy LMS 6.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in Academy LMS 6.2 on Windows. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Academy LMS 6.0 and classified as problematic. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Creativeitem Academy LMS 5.15. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.