Quick answers
- Is CVE-2026-12376 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12376 being exploited in the wild.
- How severe is CVE-2026-12376?
- Informational severity, with a CVSS score of 6.5, published 31 July 2026.
- Which products and versions are affected?
- Academy LMS Academy LMS <= 3.8.2.
- Is there a fix for CVE-2026-12376?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-12376 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-12376?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Academy LMS plugin's REST API endpoints for quiz attempts. The `quiz_attempts` and `quiz_attempts/{id}` routes fail to validate that the requesting user is either the owner of the record or an administrator. An attacker with Subscriber-level privileges (enrolled in at least one course) can provide a valid REST nonce and query these endpoints to retrieve JSON data containing sensitive fields such as `user_id`, `display_name`, registration dates, quiz results, and the `ip_address` of other users. As of the advisory date, no official patch has been confirmed for version 3.8.2.
Affected products
- Academy LMS Academy LMS <= 3.8.2
Timeline
- 2026-07-07: disclosed: Vulnerability reported to WPScan
- 2026-07-31: advisory: CVE published by NVD/WPScan