Vulnerabilities / Academy LMS / WPSEC-2026-1218
Academy LMS <= 4.0.5 - Authenticated (Subscriber+) Privilege Escalation via Student Role 'edit_posts' Capability
Medium 4.3
CWE-269Fixed in 4.0.7
- ID
- WPSEC-2026-1218
- Plugin
- Academy LMS – WordPress LMS Plugin for Complete eLearning Solution (academy)
- Affected
- all versions before 4.0.7
- Remediation
- Update to 4.0.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-269
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-18
- Attack surface
- Academy LMS on WPSec AttackSurface
- Fix released
- Published
Description
The academy plugin for WordPress is vulnerable to Privilege Escalation via the Academy Student role in all versions up to, and including, 4.0.5, due to the plugin granting the 'edit_posts' capability to the academy_student role. Any user receives this role when enrolling in a course. This makes it possible for authenticated attackers, with subscriber-level access and above, to enroll in any available course and gain contributor-level capabilities, such as creating and editing posts through the WordPress REST API and the admin.
References
- https://wpsec.com/vuln/WPSEC-2026-1218/
- https://plugins.svn.wordpress.org/academy/tags/4.0.7/
- https://wordpress.org/plugins/academy/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS