Academy LMS <= 4.0.1 - Authenticated (Contributor+) Path Traversal to Arbitrary .html File Read via Block Template Slug

ID

WPSEC-2026-0342

Plugin

Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning (academy)

Affected

all versions before 4.0.2

Remediation

Update to 4.0.2 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness

CWE-22

Usage

Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22

Attack surface

Academy LMS on WPSec AttackSurface

Fix released

2026-10-01

Published

2026-10-02

Description

The Academy LMS plugin for WordPress is vulnerable to Path Traversal via the block template slug in all versions up to, and including, 4.0.1. This is due to the get_block_file_template and block_template_is_available functions concatenating the template slug, taken from the template ID supplied to the REST templates route, into a filesystem path without validation. This makes it possible for authenticated attackers who can access the WordPress REST templates endpoint (contributor-level access and above, which can edit posts) to use '../' sequences to escape the plugin's templates directory and read the contents of arbitrary .html files on the server through the block template builder.

References

• https://wpsec.com/vuln/WPSEC-2026-0342/
• https://plugins.svn.wordpress.org/academy/tags/4.0.2/
• https://wordpress.org/plugins/academy/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS