Academy LMS students can read paid and unpublished lessons
Academy LMS before 3.8.3 returns a requested lesson through its single-lesson REST API without verifying course enrollment or the lesson's publication status. Any user who can create a self-service student account, equivalent to Subscriber access, can request arbitrary lessons and disclose paid-course material plus draft, pending and private lessons. The CNA record does not disclose the route, lesson identifier or callback.
- Component
- Academy LMS
- Plugin slug
academy-lms- Affected
- < 3.8.3
- Safe version
3.8.3- Published
- Aug 03, 2026
This CVE was published Aug 03, 2026 and is one of 4 known issues for this plugin.
Update, patch or deactivate.
Update Academy LMS to 3.8.3 or later. Review student requests for unpublished or unenrolled lesson IDs and treat sensitive draft or private lesson content as potentially exposed.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student (Subscriber-level) account to disclose the content of arbitrary lessons, including lessons of paid courses they are not enrolled in and unpublished (draft, pending, private) lessons.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N