# CVE-2026-104915: Academy LMS authorization bypass in comment deletion

Source: https://junglewise.ai/threats/cve-2026-104915-the-academy-lms-ai-course-builder-quizzes-certificates-elearning  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-104915 · Severity: medium · CVSS 6.5 · Published 2026-10-10

The Academy LMS plugin for WordPress, which provides course management and eLearning capabilities, contains an authorization flaw that allows instructors to delete lesson comments and replies belonging to other courses. An attacker with instructor access to any course can exploit this to permanently remove comments authored by other users, including administrators, causing data loss and disrupting course discussions.

Vendors: [Academy LMS](https://junglewise.ai/threats/vendors/academy-lms).

## Quick answers

**Is CVE-2026-104915 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104915 being exploited in the wild.

**How severe is CVE-2026-104915?** Medium severity, with a CVSS score of 6.5, published 10 October 2026.

**Which products and versions are affected?** Academy LMS The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning up to and including 4.0.3.

**Is there a fix for CVE-2026-104915?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-104915 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-104915?** Check whether you run Academy LMS The Academy LMS – AI Course Builder, Quizzes or Certificates & eLearning at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin fails to properly verify that a user is authorized to delete comments in a specific course, instead allowing any instructor to supply an arbitrary course_id in their request to bypass the instructor ownership check. Authenticated attackers with instructor-level access (custom-level and above) can exploit this via AJAX to delete comments and replies across courses they do not manage, leveraging a missing or inadequate authorization validation in the comment deletion functionality.

## Affected products

- Academy LMS The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning up to and including 4.0.3

## Timeline

- 2026-10-10: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php](https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php)
- [https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php](https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php)