{
 "id": "WPSEC-2026-3149",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3149/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3149/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3149/index.md",
 "title": "Academy LMS <= 4.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Lesson Comment Creation",
 "description": "The Academy LMS plugin for WordPress is vulnerable to Insecure Direct Object Reference via the lesson comment feature in versions 3.2.3 up to, and including, 4.0.5. This is due to permission to comment being checked against a course the user supplies, which is not tied to the lesson being commented on or to the comment being replied to. This makes it possible for authenticated attackers, with subscriber-level access and above, who are enrolled in any course, to post auto-approved comments and replies on lessons of courses they cannot access, or on other posts. Version 4.0.4 added the missing check to one of the two comment submission handlers, and version 4.0.7 added it to the other.",
 "plugin": {
  "slug": "academy",
  "name": "Academy LMS",
  "full_name": "Academy LMS – WordPress LMS Plugin for Complete eLearning Solution",
  "wordpress_org": "https://wordpress.org/plugins/academy/",
  "advisories_url": "https://wpsec.com/vuln/plugin/academy/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/academy"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.2.3",
    "from_inclusive": true,
    "to": "4.0.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.2.3 before 4.0.7"
  ]
 },
 "introduced_in": "3.2.3",
 "fixed_in": "4.0.7",
 "remediation": "Update to 4.0.7 or later.",
 "fix_released": "2026-10-17T07:57:01+00:00",
 "published": "2026-11-14T22:42:24+00:00",
 "updated": "2026-11-14T22:02:13.112432+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3149/",
  "https://plugins.svn.wordpress.org/academy/tags/4.0.7/",
  "https://wordpress.org/plugins/academy/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/academy",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Not seen",
  "affected_versions": "None seen",
  "as_of": "2026-11-14"
 }
}