5.4
Medium
CVE-2026-14184 The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of…
Description
The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as completed.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Academy LMS 3.8 | earliest → < 3.8.1 | 3.8.1 |
Other CVEs of Academy LMS
The 5 CVEs of Academy LMS →
CVE-2026-104050
The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting…
4.3
Medium
CVE-2026-104049
The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a…
4.3
Medium
CVE-2026-16563
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when…
6.5
Medium
CVE-2026-12376
The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing…
4.3
Medium