CVE-2024-38701 MEDIUM

CVE-2024-38701: WordPress Academy LMS plugin <= 2.0.4 - Broken Access Control vulnerability

Vendor Academy Lms

Product Academy LMS

Weakness CWE-639 · IDOR

Published July 22, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4.

Explanation of Vulnerability in Simple Terms

02Summary

Academy LMS versions up to 2.0.4 contain an authorization flaw that allows authenticated users to modify data they should not have access to. The vulnerability requires a valid user account and network access but does not require user interaction. Integrity of site data can be compromised, though confidentiality and availability are not directly affected.

What an attacker can do

03Attacker Capabilities

Modify data or settings in Academy LMS that should be restricted to other users or administrators.

Potential impact on your site

04Site Impact

Unauthorized changes to course content, user records, or site configuration by authenticated users with limited permissions.

Conditions required to exploit

05Prerequisites

Attacker must have a valid Academy LMS user account with low-level privileges.

Key dates

06Disclosure timeline

July 22, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-38701 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html AskarLabs — CWE-639 write-up Authorization Bypass Through User-Controlled Key

Related vulnerabilities