Executive brief
The Academy LMS plugin for WordPress, which is used to create and manage online learning platforms, contains a security flaw in how it handles student data. This vulnerability allows any logged-in student to view or change the private lesson notes of other students and falsely mark their course progress as complete. This could lead to unauthorized access to student information and compromise the integrity of course completion records.
Technical details
The Academy LMS plugin for WordPress fails to perform proper authorization checks in several AJAX handlers, specifically 'academy/get_lesson_note', 'academy/save_lesson_note', and 'academy/complete_lesson_video'. The root cause is an Insecure Direct Object Reference (IDOR) where the plugin does not verify if the 'user_id' parameter supplied in the request matches the identity of the authenticated user. An attacker with subscriber-level privileges can exploit this by sending crafted POST requests to 'admin-ajax.php' with a valid nonce to access or overwrite private notes and modify lesson completion status for any user ID. The issue is resolved in version 3.8.1.
Affected products
- Academy LMS Academy LMS < 3.8.1
Timeline
- 2026-06-30: disclosed: Publicly published by WPScan
- 2026-07-21: advisory: NVD publication date