# Academy LMS <= 4.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Lesson Comment Creation

- **ID:** WPSEC-2026-3149
- **Plugin:** Academy LMS – WordPress LMS Plugin for Complete eLearning Solution (`academy`), https://wordpress.org/plugins/academy/
- **Affected versions:** from 3.2.3 before 4.0.7
- **Fixed in:** 4.0.7 (Update to 4.0.7 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Not seen, affected versions None seen (as of 2026-11-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/academy
- **Fix released:** 2026-10-17
- **Published:** 2026-11-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3149/

## Description

The Academy LMS plugin for WordPress is vulnerable to Insecure Direct Object Reference via the lesson comment feature in versions 3.2.3 up to, and including, 4.0.5. This is due to permission to comment being checked against a course the user supplies, which is not tied to the lesson being commented on or to the comment being replied to. This makes it possible for authenticated attackers, with subscriber-level access and above, who are enrolled in any course, to post auto-approved comments and replies on lessons of courses they cannot access, or on other posts. Version 4.0.4 added the missing check to one of the two comment submission handlers, and version 4.0.7 added it to the other.

## References

- https://wpsec.com/vuln/WPSEC-2026-3149/
- https://plugins.svn.wordpress.org/academy/tags/4.0.7/
- https://wordpress.org/plugins/academy/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3149/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.