CVE-2026-16563
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson via REST API. Users with a Subscriber-level account can disclose the content of arbitrary lessons, including paid course lessons they are not enrolled in and unpublished lessons.
Risk Assessment
Students can access lesson content they are not authorized to view, including paid course lessons and unpublished lessons, compromising the LMS system's integrity.
Recommendation
Update the Academy LMS plugin to version 3.8.3 or later, which includes a fix verifying course enrollment and lesson publication status.
Other vulnerabilities in Academy LMS WordPress plugin
See all- CVE-2026-104050Medium
The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options. This allows any authenticated user with access to a single course, such as an enrolled student, to read the quiz answer options of questions belonging to other courses they are not enrolled in.
- CVE-2026-104049Medium
The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes. This allows users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of paid or private courses they are not enrolled in.
- CVE-2026-14184Medium
The Academy LMS WordPress plugin before version 3.8.1 does not verify ownership of user identifiers in several AJAX handlers. Authenticated users with subscriber-level access can read and modify other users' lesson notes and mark their content as completed.
Original NVD description (English source)
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student (Subscriber-level) account to disclose the content of arbitrary lessons, including lessons of paid courses they are not enrolled in and unpublished (draft, pending, private) lessons.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS