Vulnerabilities / Academy LMS
Academy LMS vulnerabilities
Advisories WPSec published for Academy LMS – WordPress LMS Plugin for Complete eLearning Solution. Other sources may list more. Its attack surface: Academy LMS on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-18 | WPSEC-2026-1219 | Academy LMS <= 4.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attempt Details via 'attempt_id' Parameter | Medium 4.3 | 4.0.7 |
| 2026-10-18 | WPSEC-2026-1218 | Academy LMS <= 4.0.5 - Authenticated (Subscriber+) Privilege Escalation via Student Role 'edit_posts' Capability | Medium 4.3 | 4.0.7 |
| 2026-10-18 | WPSEC-2026-1217 | Academy LMS <= 4.0.5 - Authenticated (Academy Instructor+) Missing Authorization to Course Publication via change_post_status | Medium 4.3 | 4.0.7 |
| 2026-10-12 | WPSEC-2026-0798 | Academy LMS <= 4.0.3 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Course Review Submission | Medium 4.3 | 4.0.4 |
| 2026-10-02 | WPSEC-2026-0342 | Academy LMS <= 4.0.1 - Authenticated (Contributor+) Path Traversal to Arbitrary .html File Read via Block Template Slug | Medium 4.3 | 4.0.2 |
License: CC BY 4.0