Academy LMS vulnerabilities

The Academy LMS plugin for WordPress up to version 3.8.0 is vulnerable to Insecure Direct Object Reference (IDOR) in the 'save_lesson_note', 'get_lesson_note', and 'complete_lesson_video' AJAX handlers due to missing validation on a user-controlled key. This allows authenticated attackers with Subscriber-level access or higher to read, overwrite, or delete private lesson notes of any other user (including administrators) and falsify lesson-completion progress for arbitrary users.

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above (enrolled in any single course) to read every user's quiz attempts across the whole site, including personal data such as IP addresses, names, registration dates and quiz results.

The Academy LMS WordPress plugin up to version 3.8.1 is vulnerable to Insecure Direct Object Reference (IDOR) in the '/topics' REST API endpoint. Lack of permission checks allows unauthenticated attackers to access detailed course data, including private, draft, scheduled, or password-protected courses.

A vulnerability has been found in Academy LMS 6.0 that leads to cross site scripting attacks. The issue affects unknown code in the file /academy/home/courses, and manipulation of the argument query/sort_by allows for remote attacks.