CVE-2026-120544 in Academy LMS Plugin
Summary
by MITRE • 11/03/2026
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the attacker-supplied path before reading it, so files with any other extension — including wp-config.php — are out of reach. The file's contents are returned in full in the REST JSON response's content field.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/03/2026
The Academy LMS plugin for WordPress contains a critical directory traversal vulnerability affecting all versions up to and including 4.0.1. This flaw resides within the handling of the 'id' parameter, which is processed without adequate sanitization or validation before being used in file system operations. The vulnerability allows authenticated attackers who possess contributor-level access or higher privileges to exploit this weakness by manipulating the input path. By supplying a crafted value for the id parameter that includes directory traversal sequences such as dot-dot-slash, an attacker can navigate outside of the intended plugin directories and access arbitrary files located on the server's file system. This represents a significant security risk because it bypasses standard isolation mechanisms designed to keep application data separate from sensitive configuration or system files.
The technical mechanism behind this exploitation involves the way the plugin constructs file paths for reading content. When an API request is made, the plugin takes the user-supplied id parameter and appends a .html extension to it before attempting to read the file. This specific behavior dictates the scope of the vulnerability. While attackers can successfully retrieve the contents of any arbitrary HTML file on the server by ensuring their traversal path ends with or targets an existing html file, they are unable to access files with other extensions. Consequently, sensitive configuration files such as wp-config.php, which typically do not have a .html extension, remain inaccessible through this specific vector. The retrieved content is then returned in full within the content field of the REST JSON response, allowing for easy extraction and exfiltration of data by the attacker.
From an operational impact perspective, this vulnerability enables unauthorized information disclosure. An authenticated user with relatively low privileges can read sensitive HTML files that may contain internal logic, hardcoded credentials stored in comments, private educational materials, or other proprietary content hosted on the server. Although the restriction to .html files limits the immediate ability to compromise database configurations or PHP source code directly via this path, it still poses a severe risk to data confidentiality and integrity. Attackers can use this access to gather intelligence about the system architecture, identify further vulnerabilities in included scripts, or steal intellectual property contained within those HTML documents. The fact that REST API responses are used for delivery means the attack is easily automatable and difficult to detect through traditional web server logs alone without specific monitoring of JSON payload contents.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as it fails to properly validate user input against expected directory boundaries. It also relates to CWE-798: Use of Hard-coded Credentials if the accessed HTML files contain embedded secrets, and CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. In terms of MITRE ATT&CK mapping, this activity corresponds to T1083: File and Directory Discovery, where adversaries explore the file system to locate valuable data for subsequent exploitation or exfiltration. The use of authenticated access with minimal privileges highlights the importance of implementing strict role-based access controls and ensuring that even low-privilege users cannot perform operations that lead to unauthorized file reads.
To mitigate this vulnerability, administrators should immediately update the Academy LMS plugin to version 4.0.2 or later where the issue has been resolved. If updating is not immediately possible, it is advisable to restrict access to the WordPress admin area and REST API endpoints using IP whitelisting or additional authentication layers such as two-factor authentication for all user accounts with contributor-level permissions or higher. Additionally, implementing a Web Application Firewall can help detect and block requests containing directory traversal patterns in parameter values. Regular security audits and penetration testing should be conducted to identify similar input validation flaws across other plugins installed on the WordPress instance, ensuring that file inclusion operations always use allowlists for permitted directories rather than relying solely on blacklist-based filtering of malicious characters.