Academy LMS <= 4.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attempt Details via 'attempt_id' Parameter
- ID
- WPSEC-2026-1219
- Plugin
- Academy LMS – WordPress LMS Plugin for Complete eLearning Solution (academy)
- Affected
- all versions before 4.0.7
- Remediation
- Update to 4.0.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-18
- Attack surface
- Academy LMS on WPSec AttackSurface
- Fix released
- Published
Description
The academy plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'attempt_id' parameter of the quiz attempt results view in all versions up to, and including, 4.0.5, due to missing validation on a user-controlled key. The template loaded and rendered the requested attempt's answers and instructor feedback without checking that the current user owned the attempt or was an instructor or administrator. This makes it possible for authenticated attackers, with subscriber-level access and above, who can open a quiz in any course they are enrolled in (or a public course) and have finished an attempt on it, to view other learners' quiz answers and instructor feedback by supplying arbitrary attempt IDs.
References
- https://wpsec.com/vuln/WPSEC-2026-1219/
- https://plugins.svn.wordpress.org/academy/tags/4.0.7/
- https://wordpress.org/plugins/academy/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS