What the vulnerability does
01Description
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.0 via the 'save_lesson_note', 'get_lesson_note', and 'complete_lesson_video' AJAX handlers due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read, overwrite, or delete the private lesson notes of any other user (including administrators), and to falsify lesson-completion progress for arbitrary users.
Explanation of Vulnerability in Simple Terms
02Summary
Academy LMS versions 3.8.0 and earlier contain an authorization flaw that allows authenticated users to modify data they should not have access to. The vulnerability requires a valid user account and network access but does not require user interaction. Integrity of site data can be compromised, though confidentiality and availability are not directly affected.
What an attacker can do
03Attacker Capabilities
Modify data or settings in Academy LMS that should be restricted to higher-privilege users.
Potential impact on your site
04Site Impact
Unauthorized changes to course content, user records, or plugin settings by low-privilege accounts.
Conditions required to exploit
05Prerequisites
Attacker must have a valid Academy LMS user account with low-level privileges.
Key dates
06Disclosure timeline
July 14, 2026
CVE published
