Academy LMS <= 4.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Lesson Comment Creation
- ID
- WPSEC-2026-3149
- Plugin
- Academy LMS – WordPress LMS Plugin for Complete eLearning Solution (academy)
- Affected
- from 3.2.3 before 4.0.7
- Remediation
- Update to 4.0.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Not seen · Affected versions None seen among sites WPSec scans, 2026-11-14
- Attack surface
- Academy LMS on WPSec AttackSurface
- Fix released
- Published
Description
The Academy LMS plugin for WordPress is vulnerable to Insecure Direct Object Reference via the lesson comment feature in versions 3.2.3 up to, and including, 4.0.5. This is due to permission to comment being checked against a course the user supplies, which is not tied to the lesson being commented on or to the comment being replied to. This makes it possible for authenticated attackers, with subscriber-level access and above, who are enrolled in any course, to post auto-approved comments and replies on lessons of courses they cannot access, or on other posts. Version 4.0.4 added the missing check to one of the two comment submission handlers, and version 4.0.7 added it to the other.
References
- https://wpsec.com/vuln/WPSEC-2026-3149/
- https://plugins.svn.wordpress.org/academy/tags/4.0.7/
- https://wordpress.org/plugins/academy/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS