4.3
Medium
CVE-2026-104050 The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting…
Description
The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to read the quiz answer options of questions belonging to other courses they are not enrolled in.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Academy LMS 4.0 | earliest → < 4.0.0 | 4.0.0 |
Other CVEs of Academy LMS
The 5 CVEs of Academy LMS →
CVE-2026-104049
The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a…
4.3
Medium
CVE-2026-16563
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when…
6.5
Medium
CVE-2026-12376
The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing…
4.3
Medium
CVE-2026-14184
The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of…
5.4
Medium