Academy LMS <= 4.0.7 - Authenticated (Academy Instructor+) Insecure Direct Object Reference to Other Instructors' Course Attachment Download Records
- ID
- WPSEC-2026-1672
- Plugin
- Academy LMS – WordPress LMS Plugin for Complete eLearning Solution (academy)
- Affected
- from 4.0.0 before 4.0.8
- Remediation
- Update to 4.0.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-27
- Attack surface
- Academy LMS on WPSec AttackSurface
- Fix released
- Published
Description
The academy plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'course_id' parameter of the attachment_downloads REST route in versions 4.0.0 up to, and including, 4.0.7, due to the route's permission callback checking only for the 'manage_academy_instructor' capability and not that the requesting instructor owns the course. This makes it possible for authenticated attackers, with Academy Instructor-level access and above, to read the attachment download records of courses owned by other instructors, including the names of the students who downloaded each lesson attachment and their download counts and times.
References
- https://wpsec.com/vuln/WPSEC-2026-1672/
- https://plugins.svn.wordpress.org/academy/tags/4.0.8/
- https://wordpress.org/plugins/academy/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS