{
 "id": "WPSEC-2026-1219",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1219/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1219/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1219/index.md",
 "title": "Academy LMS <= 4.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attempt Details via 'attempt_id' Parameter",
 "description": "The academy plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'attempt_id' parameter of the quiz attempt results view in all versions up to, and including, 4.0.5, due to missing validation on a user-controlled key. The template loaded and rendered the requested attempt's answers and instructor feedback without checking that the current user owned the attempt or was an instructor or administrator. This makes it possible for authenticated attackers, with subscriber-level access and above, who can open a quiz in any course they are enrolled in (or a public course) and have finished an attempt on it, to view other learners' quiz answers and instructor feedback by supplying arbitrary attempt IDs.",
 "plugin": {
  "slug": "academy",
  "name": "Academy LMS",
  "full_name": "Academy LMS – WordPress LMS Plugin for Complete eLearning Solution",
  "wordpress_org": "https://wordpress.org/plugins/academy/",
  "advisories_url": "https://wpsec.com/vuln/plugin/academy/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/academy"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.0.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.0.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.0.7",
 "remediation": "Update to 4.0.7 or later.",
 "fix_released": "2026-10-17T07:57:01+00:00",
 "published": "2026-10-18T11:43:06+00:00",
 "updated": "2026-10-18T11:13:25.847502+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1219/",
  "https://plugins.svn.wordpress.org/academy/tags/4.0.7/",
  "https://wordpress.org/plugins/academy/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/academy",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-18"
 }
}