# Nias course <= 1.3.3 - Unauthenticated Insecure Direct Object Reference to Certificate Forgery via generate_certificate AJAX Action

- **ID:** WPSEC-2026-2824
- **Plugin:** Nias Course Builder (`nias-course`), https://wordpress.org/plugins/nias-course/
- **Affected versions:** from 1.2.7 before 2.0.0
- **Fixed in:** 2.0.0 (Update to 2.0.0 or later.)
- **Severity:** Medium 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/nias-course
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2824/

## Description

The Nias Course Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference via the generate_certificate AJAX action (handle_certificate_generation) in all versions up to, and including, 1.3.3, due to missing validation that the requested user_id belongs to the current user and that the submitted certificate code, course name and date match a certificate actually issued. The handler is registered for unauthenticated users and is protected only by a shared nonce that is printed on the certificate page for any logged-in student with an eligible course and for any visitor opening a valid certificate verification link. This makes it possible for unauthenticated attackers who obtain such a nonce to generate certificate PDFs for any user ID with an arbitrary course name, date and certificate code, forging certificates in another user's name and exposing that user's first and last name.

## References

- https://wpsec.com/vuln/WPSEC-2026-2824/
- https://plugins.svn.wordpress.org/nias-course/tags/2.0.0/
- https://wordpress.org/plugins/nias-course/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2824/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.