CVE-2026-104049 in Academy LMS Plugin
Summary
by MITRE • 10/07/2026
The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of paid or private courses they are not enrolled in.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in The Academy LMS WordPress plugin prior to version 4.0.0 represents a critical failure in access control mechanisms within its REST API implementation. This flaw specifically affects the logic governing how lesson content is retrieved and served to users through various application programming interface endpoints. In secure learning management systems, it is imperative that any request for educational material undergoes rigorous validation to ensure the requesting user has legitimate authorization to view that specific resource. However, in this instance, the plugin fails to verify course enrollment status or object ownership when processing requests for lesson data. This architectural oversight allows unauthenticated or improperly authenticated users to bypass intended restrictions and access content that should be restricted based on subscription level or private setting configurations.
From a technical perspective, the root cause lies in the absence of proper authorization checks within the REST API handlers responsible for delivering lesson bodies. When a user initiates a request to retrieve lesson content, the system does not cross-reference the user's account permissions against the course metadata associated with that lesson. Consequently, any individual possessing a self-registerable student account can construct valid API requests targeting arbitrary lesson identifiers. Since the server processes these requests without validating whether the requester is actually enrolled in the parent course or has paid for access to private materials, it returns the full textual and multimedia content of the lesson. This behavior effectively neutralizes the security controls designed to protect premium or confidential educational assets from unauthorized distribution.
The operational impact of this vulnerability is significant for organizations relying on The Academy LMS for monetized education or sensitive internal training. Attackers can systematically enumerate course IDs and lesson slugs to harvest proprietary curriculum, exam questions, instructional videos, and other intellectual property without incurring costs. This leads directly to financial loss through piracy of paid courses and potential reputational damage if confidential corporate training materials are leaked publicly. Furthermore, the exposure of private course content violates data privacy expectations and may breach contractual obligations with clients or students who expect their learning paths to remain exclusive. The ease of exploitation means that even users with minimal technical expertise can exploit this flaw using standard web tools or simple scripts to scrape large volumes of restricted content rapidly.
This vulnerability aligns closely with Common Weakness Enumeration identifier CWE-284, which describes Improper Access Control, as well as CWE-601, URL Redirection to Untrusted Site (Open Redirect) in the broader context of API misuse where input validation is insufficient. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques involving Unauthorized Access to Resources and potentially Data Exfiltration via Application Layer protocols such as REST APIs. The lack of server-side enforcement for business logic regarding user entitlements allows attackers to bypass client-side restrictions that might otherwise limit visibility in a standard web interface.
To mitigate this risk, administrators must immediately upgrade the plugin to version 4.0.0 or later where these access control checks have been implemented and validated by developers. Until an update is applied, temporary mitigations include restricting API endpoint access via firewall rules if possible, although this may impact legitimate functionality. It is also advisable to audit user roles and ensure that only trusted administrators can modify course settings while monitoring logs for unusual patterns of lesson content retrieval. Regular security audits focusing on REST API authorization logic are recommended to prevent similar flaws in other plugins or custom code within the WordPress ecosystem. Ensuring strict enforcement of object-level permissions at the server side is essential to maintaining the integrity and confidentiality of digital learning environments.