4.3
Moyenne
CVE-2026-104050 The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting…
Description
The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to read the quiz answer options of questions belonging to other courses they are not enrolled in.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Academy LMS 4.0 | premières → < 4.0.0 | 4.0.0 |
Autres CVE de Academy LMS
Les 5 CVE de Academy LMS →
CVE-2026-104049
The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a…
4.3
Moyenne
CVE-2026-16563
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when…
6.5
Moyenne
CVE-2026-12376
The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing…
4.3
Moyenne
CVE-2026-14184
The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of…
5.4
Moyenne