Kodezen
Monthly
Privilege escalation in the aBlocks WordPress plugin (Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder) through 2.17.0 lets an authenticated attacker with Contributor-level access or above raise their own WordPress role to Editor and receive a fully authenticated session at the elevated level. The flaw sits in the plugin's `/ablocks/v1/form-builder/registration` REST endpoint, which is registered with `permission_callback => __return_true` and whose `register()` handler reads `roleSlug` from attacker-controlled block attributes without confirming the block's `formType` is actually `registration`; the save-time sanitizer only enforces that constraint for registration blocks. Impact is bounded below administrator - `is_safe_registration_role()` rejects any role carrying `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, so Editor is the highest role practically reachable on a standard installation. No public exploit code or active exploitation is identified at time of analysis, and the CVSS vector (PR:L) confirms the attack requires authentication.
Authenticated users with contributor-level access or above on WordPress sites running the Academy LMS plugin through version 4.0.1 can read the contents of arbitrary .html files from the server by supplying directory-traversal sequences in the 'id' parameter of a REST endpoint; the file contents are returned in full in the JSON response's content field. Impact is deliberately narrow: the plugin appends a '.html' extension to the attacker-supplied path before reading, so wp-config.php, PHP source, and any non-.html file cannot be reached. This is a moderate, not urgent, issue - no active exploitation is confirmed (not in CISA KEV) and no public exploit identified at time of analysis.
Authenticated privilege escalation in the Academy LMS WordPress plugin through version 4.0.3 lets a user with the academy_guardian role or higher assign the academy_student role to any existing WordPress account, including their own, via the guardian add_child REST API. The flaw stems from add_role('academy_student') executing before Store::link() validates the guardian-ward relationship and not rolling back on WP_Error, so even self-links rejected by Store::link() leave the role grant in place. This yields Contributor-equivalent edit_posts unconditionally and Author-equivalent upload_files only when the student file-upload setting is enabled; CVSS is 5.4 and no public exploit has been identified at time of analysis.
Authorization bypass in the Academy LMS - AI Course Builder, Quizzes, Certificates & eLearning WordPress plugin (all versions up to and including 4.0.3) allows any user who holds an instructor role for at least one course to permanently delete lesson comments and their replies belonging to courses they do not instruct, including comments authored by administrators. Exploitation requires an authenticated account with instructor-level access (CVSS PR:L), and the attacker supplies their own valid course_id to pass the plugin's flawed instructor check while targeting comment IDs from other courses; the abuse results in irreversible content destruction (integrity impact High, confidentiality and availability unaffected per the assessed vector). No public exploit code has been identified at time of analysis, the issue is not listed as confirmed actively exploited (CISA KEV), and the assessed severity is moderate (CVSS 6.5) rather than an emergency, primarily because the instructor-account prerequisite confines the threat to semi-trusted internal users.
Directory traversal in the StoreEngine WordPress plugin (Kodezen) through version 2.1.1 exposes arbitrary server files to authenticated users holding vendor-level access or higher. The flaw resides in the `parse_file_path` function, which insufficiently sanitizes file path input across the plugin's download handler and multi-vendor addon components, allowing path sequences to escape the intended directory. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the confidentiality impact is high given that readable files may include WordPress configuration, database credentials, or private keys.
Insecure Direct Object Reference in the Academy LMS WordPress plugin (all versions through 3.8.0) allows authenticated attackers with Subscriber-level access to read, overwrite, or delete the private lesson notes of any user - including administrators - and to falsify lesson-completion records for arbitrary accounts. Three AJAX handlers (save_lesson_note, get_lesson_note, complete_lesson_video) perform no ownership validation on a user-controlled key, making cross-user data manipulation trivially achievable by any registered site user. No public exploit identified at time of analysis, but the attack surface is fully described via Wordfence's public threat-intelligence entry and source-level code references.
Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.0.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Academy LMS academy.9.16. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Academy LMS academy.9.25. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Academy LMS.9.16. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Academy LMS - eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
Privilege escalation in the aBlocks WordPress plugin (Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder) through 2.17.0 lets an authenticated attacker with Contributor-level access or above raise their own WordPress role to Editor and receive a fully authenticated session at the elevated level. The flaw sits in the plugin's `/ablocks/v1/form-builder/registration` REST endpoint, which is registered with `permission_callback => __return_true` and whose `register()` handler reads `roleSlug` from attacker-controlled block attributes without confirming the block's `formType` is actually `registration`; the save-time sanitizer only enforces that constraint for registration blocks. Impact is bounded below administrator - `is_safe_registration_role()` rejects any role carrying `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, so Editor is the highest role practically reachable on a standard installation. No public exploit code or active exploitation is identified at time of analysis, and the CVSS vector (PR:L) confirms the attack requires authentication.
Authenticated users with contributor-level access or above on WordPress sites running the Academy LMS plugin through version 4.0.1 can read the contents of arbitrary .html files from the server by supplying directory-traversal sequences in the 'id' parameter of a REST endpoint; the file contents are returned in full in the JSON response's content field. Impact is deliberately narrow: the plugin appends a '.html' extension to the attacker-supplied path before reading, so wp-config.php, PHP source, and any non-.html file cannot be reached. This is a moderate, not urgent, issue - no active exploitation is confirmed (not in CISA KEV) and no public exploit identified at time of analysis.
Authenticated privilege escalation in the Academy LMS WordPress plugin through version 4.0.3 lets a user with the academy_guardian role or higher assign the academy_student role to any existing WordPress account, including their own, via the guardian add_child REST API. The flaw stems from add_role('academy_student') executing before Store::link() validates the guardian-ward relationship and not rolling back on WP_Error, so even self-links rejected by Store::link() leave the role grant in place. This yields Contributor-equivalent edit_posts unconditionally and Author-equivalent upload_files only when the student file-upload setting is enabled; CVSS is 5.4 and no public exploit has been identified at time of analysis.
Authorization bypass in the Academy LMS - AI Course Builder, Quizzes, Certificates & eLearning WordPress plugin (all versions up to and including 4.0.3) allows any user who holds an instructor role for at least one course to permanently delete lesson comments and their replies belonging to courses they do not instruct, including comments authored by administrators. Exploitation requires an authenticated account with instructor-level access (CVSS PR:L), and the attacker supplies their own valid course_id to pass the plugin's flawed instructor check while targeting comment IDs from other courses; the abuse results in irreversible content destruction (integrity impact High, confidentiality and availability unaffected per the assessed vector). No public exploit code has been identified at time of analysis, the issue is not listed as confirmed actively exploited (CISA KEV), and the assessed severity is moderate (CVSS 6.5) rather than an emergency, primarily because the instructor-account prerequisite confines the threat to semi-trusted internal users.
Directory traversal in the StoreEngine WordPress plugin (Kodezen) through version 2.1.1 exposes arbitrary server files to authenticated users holding vendor-level access or higher. The flaw resides in the `parse_file_path` function, which insufficiently sanitizes file path input across the plugin's download handler and multi-vendor addon components, allowing path sequences to escape the intended directory. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the confidentiality impact is high given that readable files may include WordPress configuration, database credentials, or private keys.
Insecure Direct Object Reference in the Academy LMS WordPress plugin (all versions through 3.8.0) allows authenticated attackers with Subscriber-level access to read, overwrite, or delete the private lesson notes of any user - including administrators - and to falsify lesson-completion records for arbitrary accounts. Three AJAX handlers (save_lesson_note, get_lesson_note, complete_lesson_video) perform no ownership validation on a user-controlled key, making cross-user data manipulation trivially achievable by any registered site user. No public exploit identified at time of analysis, but the attack surface is fully described via Wordfence's public threat-intelligence entry and source-level code references.
Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.0.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Academy LMS academy.9.16. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Academy LMS academy.9.25. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Academy LMS.9.16. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Academy LMS - eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.