5.4
Moyenne
CVE-2026-14184 The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of…
Description
The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as completed.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Academy LMS 3.8 | premières → < 3.8.1 | 3.8.1 |
Autres CVE de Academy LMS
Les 5 CVE de Academy LMS →
CVE-2026-104050
The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting…
4.3
Moyenne
CVE-2026-104049
The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a…
4.3
Moyenne
CVE-2026-16563
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when…
6.5
Moyenne
CVE-2026-12376
The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing…
4.3
Moyenne