Academy Lms
Monthly
An authorization flaw in the Academy LMS WordPress plugin before 4.0.0 allows any authenticated user who is enrolled in at least one course - such as an ordinary student - to read the quiz answer options for questions that belong to other courses they are not enrolled in. Because the plugin fails to verify that a referenced quiz question actually belongs to a course the requester can access, a valid session plus minimal enrollment is enough to pull answer data across course boundaries; publicly available exploit code exists, though there is no evidence of confirmed active exploitation. Independent assessment rates this as a genuine but low-priority issue - authentication is mandatory (PR:L), no anonymous exploitation is possible, impact is limited to confidentiality of quiz answers (no write, no takeover), and the attack is not automatable at scale per SSVC (Automatable: no).
Information disclosure in the Academy LMS WordPress plugin before 4.0.0 allows an authenticated student - including one who simply self-registers when open registration is enabled - to read the full content of arbitrary lessons through an under-protected REST API route, including lessons belonging to paid or private courses they are not enrolled in. The issue is an authorization/ownership-check failure (CWE-639) rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and publicly available exploit code exists, although CISA's SSVC assessment records no observed exploitation and classifies the issue as not automatable. Impact is bounded to confidentiality of lesson content - no data modification, no site disruption - and installations that disable open student self-registration materially raise the barrier to entry.
Unauthorized lesson content disclosure in Academy LMS WordPress plugin before 3.8.3 allows any subscriber-level authenticated user to read arbitrary lesson content via the REST API - including lessons from paid courses they have not purchased and lessons in unpublished states (draft, pending, private). The root cause is a complete absence of enrollment and publication-status validation in the single-lesson REST API endpoint. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.13% (3rd percentile) and SSVC classification as non-automatable indicate limited observed exploitation activity at the time of analysis.
Broken Object Level Authorization in the Academy LMS WordPress plugin through 3.8.2 exposes every user's quiz attempt records - including IP addresses, full names, registration dates, and quiz results - to any authenticated subscriber-level user who is enrolled in at least one course. The flaw stems from missing ownership checks on quiz attempt record retrieval endpoints (CWE-639), enabling horizontal privilege escalation across the entire site's student population. A publicly available proof-of-concept exists per WPScan; exploitation probability remains low (EPSS 0.13%, 3rd percentile) with no confirmed active exploitation in CISA KEV.
Academy LMS WordPress plugin versions prior to 3.8.1 exposes an Insecure Direct Object Reference (IDOR) flaw across multiple lesson AJAX handlers, allowing any subscriber-level authenticated user to read and overwrite other users' lesson notes and fraudulently mark course content as completed on their behalf. The vulnerability affects all Academy LMS installations running an unpatched version and is worsened by a publicly available exploit published via WPScan, though no active exploitation has been confirmed through CISA KEV. In environments where course completion carries compliance, certification, or audit significance, the integrity impact exceeds what the Medium CVSS score alone conveys.
Insecure Direct Object Reference in the Academy LMS WordPress plugin (all versions through 3.8.0) allows authenticated attackers with Subscriber-level access to read, overwrite, or delete the private lesson notes of any user - including administrators - and to falsify lesson-completion records for arbitrary accounts. Three AJAX handlers (save_lesson_note, get_lesson_note, complete_lesson_video) perform no ownership validation on a user-controlled key, making cross-user data manipulation trivially achievable by any registered site user. No public exploit identified at time of analysis, but the attack surface is fully described via Wordfence's public threat-intelligence entry and source-level code references.
Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the string parameter to the /academy/course_bundles/search/query endpoint. [CVSS 6.1 MEDIUM]
Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.0.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing Authorization vulnerability in Academy LMS academy.9.16. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Academy LMS academy.9.25. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Academy LMS.9.16. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Academy LMS - eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
A vulnerability was found in Academy LMS 6.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in Academy LMS 6.2 on Windows. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Academy LMS 6.0 and classified as problematic. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Creativeitem Academy LMS 5.15. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An authorization flaw in the Academy LMS WordPress plugin before 4.0.0 allows any authenticated user who is enrolled in at least one course - such as an ordinary student - to read the quiz answer options for questions that belong to other courses they are not enrolled in. Because the plugin fails to verify that a referenced quiz question actually belongs to a course the requester can access, a valid session plus minimal enrollment is enough to pull answer data across course boundaries; publicly available exploit code exists, though there is no evidence of confirmed active exploitation. Independent assessment rates this as a genuine but low-priority issue - authentication is mandatory (PR:L), no anonymous exploitation is possible, impact is limited to confidentiality of quiz answers (no write, no takeover), and the attack is not automatable at scale per SSVC (Automatable: no).
Information disclosure in the Academy LMS WordPress plugin before 4.0.0 allows an authenticated student - including one who simply self-registers when open registration is enabled - to read the full content of arbitrary lessons through an under-protected REST API route, including lessons belonging to paid or private courses they are not enrolled in. The issue is an authorization/ownership-check failure (CWE-639) rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and publicly available exploit code exists, although CISA's SSVC assessment records no observed exploitation and classifies the issue as not automatable. Impact is bounded to confidentiality of lesson content - no data modification, no site disruption - and installations that disable open student self-registration materially raise the barrier to entry.
Unauthorized lesson content disclosure in Academy LMS WordPress plugin before 3.8.3 allows any subscriber-level authenticated user to read arbitrary lesson content via the REST API - including lessons from paid courses they have not purchased and lessons in unpublished states (draft, pending, private). The root cause is a complete absence of enrollment and publication-status validation in the single-lesson REST API endpoint. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.13% (3rd percentile) and SSVC classification as non-automatable indicate limited observed exploitation activity at the time of analysis.
Broken Object Level Authorization in the Academy LMS WordPress plugin through 3.8.2 exposes every user's quiz attempt records - including IP addresses, full names, registration dates, and quiz results - to any authenticated subscriber-level user who is enrolled in at least one course. The flaw stems from missing ownership checks on quiz attempt record retrieval endpoints (CWE-639), enabling horizontal privilege escalation across the entire site's student population. A publicly available proof-of-concept exists per WPScan; exploitation probability remains low (EPSS 0.13%, 3rd percentile) with no confirmed active exploitation in CISA KEV.
Academy LMS WordPress plugin versions prior to 3.8.1 exposes an Insecure Direct Object Reference (IDOR) flaw across multiple lesson AJAX handlers, allowing any subscriber-level authenticated user to read and overwrite other users' lesson notes and fraudulently mark course content as completed on their behalf. The vulnerability affects all Academy LMS installations running an unpatched version and is worsened by a publicly available exploit published via WPScan, though no active exploitation has been confirmed through CISA KEV. In environments where course completion carries compliance, certification, or audit significance, the integrity impact exceeds what the Medium CVSS score alone conveys.
Insecure Direct Object Reference in the Academy LMS WordPress plugin (all versions through 3.8.0) allows authenticated attackers with Subscriber-level access to read, overwrite, or delete the private lesson notes of any user - including administrators - and to falsify lesson-completion records for arbitrary accounts. Three AJAX handlers (save_lesson_note, get_lesson_note, complete_lesson_video) perform no ownership validation on a user-controlled key, making cross-user data manipulation trivially achievable by any registered site user. No public exploit identified at time of analysis, but the attack surface is fully described via Wordfence's public threat-intelligence entry and source-level code references.
Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the string parameter to the /academy/course_bundles/search/query endpoint. [CVSS 6.1 MEDIUM]
Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.0.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing Authorization vulnerability in Academy LMS academy.9.16. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Academy LMS academy.9.25. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Academy LMS.9.16. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Academy LMS - eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
A vulnerability was found in Academy LMS 6.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in Academy LMS 6.2 on Windows. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Academy LMS 6.0 and classified as problematic. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Creativeitem Academy LMS 5.15. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.