Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Academy LMS 4.0.0 Clear all filters
TI-2026-69022 CVE-2026-104050 · GHSA-rg55-r6h3-vvf2

Academy LMS plugin exposes quiz answers across courses to students

Priority LOW 19

The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authentic…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00162 Published 2026-10-07 Fixed in 4.0.0 CWE-639
TI-2026-69021 CVE-2026-104049 · GHSA-43m9-7565-v53c

Academy LMS exposes lesson content to unenrolled students via REST API

Priority LOW 19

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student ac…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00162 Published 2026-10-07 Fixed in 4.0.0 CWE-639