# Academy LMS <= 4.0.7 - Authenticated (Academy Instructor+) Insecure Direct Object Reference to Other Instructors' Course Attachment Download Records

- **ID:** WPSEC-2026-1672
- **Plugin:** Academy LMS – WordPress LMS Plugin for Complete eLearning Solution (`academy`), https://wordpress.org/plugins/academy/
- **Affected versions:** from 4.0.0 before 4.0.8
- **Fixed in:** 4.0.8 (Update to 4.0.8 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/academy
- **Fix released:** 2026-10-25
- **Published:** 2026-10-26
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1672/

## Description

The academy plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'course_id' parameter of the attachment_downloads REST route in versions 4.0.0 up to, and including, 4.0.7, due to the route's permission callback checking only for the 'manage_academy_instructor' capability and not that the requesting instructor owns the course. This makes it possible for authenticated attackers, with Academy Instructor-level access and above, to read the attachment download records of courses owned by other instructors, including the names of the students who downloaded each lesson attachment and their download counts and times.

## References

- https://wpsec.com/vuln/WPSEC-2026-1672/
- https://plugins.svn.wordpress.org/academy/tags/4.0.8/
- https://wordpress.org/plugins/academy/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1672/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.