# Academy LMS <= 4.0.5 - Authenticated (Subscriber+) Privilege Escalation via Student Role 'edit_posts' Capability

- **ID:** WPSEC-2026-1218
- **Plugin:** Academy LMS – WordPress LMS Plugin for Complete eLearning Solution (`academy`), https://wordpress.org/plugins/academy/
- **Affected versions:** all versions before 4.0.7
- **Fixed in:** 4.0.7 (Update to 4.0.7 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-269
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-18)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/academy
- **Fix released:** 2026-10-17
- **Published:** 2026-10-18
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1218/

## Description

The academy plugin for WordPress is vulnerable to Privilege Escalation via the Academy Student role in all versions up to, and including, 4.0.5, due to the plugin granting the 'edit_posts' capability to the academy_student role. Any user receives this role when enrolling in a course. This makes it possible for authenticated attackers, with subscriber-level access and above, to enroll in any available course and gain contributor-level capabilities, such as creating and editing posts through the WordPress REST API and the admin.

## References

- https://wpsec.com/vuln/WPSEC-2026-1218/
- https://plugins.svn.wordpress.org/academy/tags/4.0.7/
- https://wordpress.org/plugins/academy/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1218/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.