# Academy LMS <= 4.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attempt Details via 'attempt_id' Parameter

- **ID:** WPSEC-2026-1219
- **Plugin:** Academy LMS – WordPress LMS Plugin for Complete eLearning Solution (`academy`), https://wordpress.org/plugins/academy/
- **Affected versions:** all versions before 4.0.7
- **Fixed in:** 4.0.7 (Update to 4.0.7 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-18)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/academy
- **Fix released:** 2026-10-17
- **Published:** 2026-10-18
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1219/

## Description

The academy plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'attempt_id' parameter of the quiz attempt results view in all versions up to, and including, 4.0.5, due to missing validation on a user-controlled key. The template loaded and rendered the requested attempt's answers and instructor feedback without checking that the current user owned the attempt or was an instructor or administrator. This makes it possible for authenticated attackers, with subscriber-level access and above, who can open a quiz in any course they are enrolled in (or a public course) and have finished an attempt on it, to view other learners' quiz answers and instructor feedback by supplying arbitrary attempt IDs.

## References

- https://wpsec.com/vuln/WPSEC-2026-1219/
- https://plugins.svn.wordpress.org/academy/tags/4.0.7/
- https://wordpress.org/plugins/academy/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1219/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.