Junglewise Threat Intelligence

CVE-2026-5348: Academy LMS WordPress plugin IDOR in topics REST API endpoint

CVE-2026-5348 · Severity: medium · CVSS 5.3 · Published 2026-07-02

Technologies: Kodezen Academy LMS. Vendors: Kodezen.

Executive brief

The Academy LMS plugin for WordPress, which is used to create and manage online learning platforms, contains a security flaw that allows unauthorized access to course content. An attacker can view curriculum details for courses that are supposed to be private, password-protected, or still in draft mode. This could lead to the exposure of proprietary educational materials and intellectual property before its intended release.

Technical details

The Academy LMS plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability due to an improperly secured REST API endpoint. The '/topics' endpoint is registered with a permission callback set to '__return_true', which bypasses authorization checks. This allows unauthenticated attackers to retrieve course curriculum data by enumerating course IDs via the API. The vulnerability affects private, draft, scheduled, and password-protected courses, as the system fails to verify the course's post status or the user's enrollment status before returning data. The issue is present in versions up to and including 3.8.1.

Affected products

  • kodezen Academy LMS – WordPress LMS Plugin for Complete eLearning Solution up to, and including, 3.8.1

Timeline

  • 2026-07-02: advisory: NVD publication date

References