Executive brief
The Academy LMS plugin for WordPress, which is used to manage online courses and student quizzes, contains a security flaw that allows students to view the private quiz records of all other users on the site. By exploiting this issue, any logged-in user enrolled in at least one course can access sensitive information including other students' names, quiz scores, registration dates, and IP addresses. This could lead to significant privacy violations and the exposure of personal data across the entire learning platform.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Academy LMS plugin's REST API endpoints for quiz attempts. The `quiz_attempts` and `quiz_attempts/{id}` routes fail to validate that the requesting user is either the owner of the record or an administrator. An attacker with Subscriber-level privileges (enrolled in at least one course) can provide a valid REST nonce and query these endpoints to retrieve JSON data containing sensitive fields such as `user_id`, `display_name`, registration dates, quiz results, and the `ip_address` of other users. As of the advisory date, no official patch has been confirmed for version 3.8.2.
Affected products
- Academy LMS Academy LMS <= 3.8.2
Timeline
- 2026-07-07: disclosed: Vulnerability reported to WPScan
- 2026-07-31: advisory: CVE published by NVD/WPScan