Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Oct 9, 2026Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning: Authorization bypassCVE-2026-104915 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to permanently delete arbitrary Academy lesson comments and their replies authored by any user, including administrators, across courses they do not instruct. This is exploitable by any user registered as an Academy instructor for at least one course, as they can supply their own course_id to pass the instructor check while targeting comments belonging to entirely different courses.
- Product
- Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2026Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning: Privilege EscalationCVE-2026-104022 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the `add_child()` function calling `add_role('academy_student')` on any existing account resolved from the attacker-supplied `email` parameter before `Store::link()` validates the guardian-ward relationship, and failing to roll back that role write when `Store::link()` returns a `WP_Error`. This makes it possible for authenticated attackers with the `academy_guardian` role or higher to elevate any existing WordPress account — including their own — to the `academy_student` role, gaining `edit_posts` (Contributor-equivalent) capabilities and, when the student file-upload setting is enabled, `upload_files` (Author-equivalent) capabilities not granted to the guardian role. When a guardian supplies their own email address, `email_exists()` resolves to their own user ID, causing `Store::link()` to reject the self-link, but because the `add_role()` call has already executed and is never reversed, the academy_student role grant on their own account persists permanently.
- Product
- Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 7, 2026Academy LMS: Does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer optionsCVE-2026-104050 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to read the quiz answer options of questions belonging to other courses they are not enrolled in.
- Product
- Academy LMS
- Fixed in
- 4.0.0
- What to do
- Update Academy LMS to 4.0.0 or newer.
Oct 7, 2026Academy LMS: Does not verify course enrollment or object ownershipCVE-2026-104049 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of paid or private courses they are not enrolled in.
- Product
- Academy LMS
- Fixed in
- 4.0.0
- What to do
- Update Academy LMS to 4.0.0 or newer.
Aug 3, 2026Academy LMS: Does not verify course enrollment or lesson publication statusCVE-2026-16563 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student (Subscriber-level) account to disclose the content of arbitrary lessons, including lessons of paid courses they are not enrolled in and unpublished (draft, pending, private) lessons.
- Product
- Academy LMS
- Fixed in
- 3.8.3
- What to do
- Update Academy LMS to 3.8.3 or newer.
Jul 31, 2026Academy LMS: Does not restrict access to quiz attempt records to their ownerCVE-2026-12376 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above (enrolled in any single course) to read every user's quiz attempts across the whole site, including personal data such as IP addresses, names, registration dates and quiz results.
- Product
- Academy LMS
- Affected
- up to 3.8.2
- What to do
- Affects up to 3.8.2. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 21, 2026Academy LMS: Does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlersCVE-2026-14184 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as completed.
- Product
- Academy LMS
- Fixed in
- 3.8.1
- What to do
- Update Academy LMS to 3.8.1 or newer.
Jul 14, 2026Academy LMS – WordPress LMS Plugin for Complete eLearning Solution: Insecure Direct Object ReferenceCVE-2026-9341 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.0 via the 'save_lesson_note', 'get_lesson_note', and 'complete_lesson_video' AJAX handlers due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read, overwrite, or delete the private lesson notes of any other user (including administrators), and to falsify lesson-completion progress for arbitrary users.
- Product
- Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
- Affected
- up to 3.8.0
- What to do
- Affects up to 3.8.0. Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 2, 2026Academy LMS – WordPress LMS Plugin for Complete eLearning Solution: Insecure Direct Object ReferenceCVE-2026-5348 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.8.1. This is due to the '/topics' REST API endpoint being registered with a permission callback set to '__return_true', allowing unauthenticated access to course curriculum data without verifying the course's post status or user enrollment. This makes it possible for unauthenticated attackers to access detailed curriculum information for private, draft, scheduled, or password-protected courses by enumerating course IDs.
- Product
- Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 17, 2026Academy LMS Pro: Unrestricted Upload of File with Dangerous TypeCVE-2026-39598 · WordPress plugins & themes · reported by PatchstackHigh 8
Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server. This issue affects Academy LMS Pro: from n/a before 3.5.2.
- Product
- Academy LMS Pro
- Fixed in
- 3.5.2
- What to do
- Update Academy LMS Pro to 3.5.2 or newer.
Feb 19, 2026Academy LMS: Missing AuthorizationCVE-2026-25372 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Academy LMS: from n/a through <= 3.5.3.
- Product
- Academy LMS
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 20, 2026Academy LMS – WordPress LMS Plugin for Complete eLearning Solution: Privilege escalationCVE-2025-15521 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.5.0. This is due to the plugin not properly validating a user's identity prior to updating their password and relying solely on a publicly-exposed nonce for authorization. This makes it possible for unauthenticated attackers to change arbitrary user's password, including administrators, and gain access to their account.
- Product
- Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
- Affected
- up to 3.5.0
- What to do
- Affects up to 3.5.0. Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 24, 2025Academy LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC Academy LMS academy allows Stored XSS.This issue affects Academy LMS: from n/a through <= 3.4.0.
- Product
- Academy LMS
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2025Academy LMS – WordPress LMS Plugin for Complete eLearning Solution: PHP Object InjectionCVE-2025-12099 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.8 via deserialization of untrusted input in the 'import_all_courses' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- Product
- Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
- Affected
- up to 3.3.8
- What to do
- Affects up to 3.3.8. Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 8, 2025Academy LMS – WordPress LMS Plugin for Complete eLearning Solution: Sensitive Information ExposureCVE-2025-12098 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.8 via the 'enqueue_social_login_script' function. This makes it possible for unauthenticated attackers to extract sensitive data including the Facebook App Secret if Facebook Social Login is enabled.
- Product
- Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
- Affected
- up to 3.3.8
- What to do
- Affects up to 3.3.8. Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordacademylms.networdfence.com
Oct 22, 2025Academy LMS – WordPress LMS Plugin for Complete eLearning Solution: Privilege escalationCVE-2025-11086 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.7. This is due to the plugin not properly validating a user's role prior to registering a user via the Social Login addon. This makes it possible for unauthenticated attackers to update their role to Administrator when registering on the site.
- Product
- Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
- Affected
- up to 3.3.7
- What to do
- Affects up to 3.3.7. Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordacademylms.netacademylms.net
Sep 22, 2025Academy LMS: Authorization Bypass Through User-Controlled KeyCVE-2025-59562 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Authorization Bypass Through User-Controlled Key vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Academy LMS: from n/a through <= 3.3.4.
- Product
- Academy LMS
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 22, 2024Academy LMS: Authorization Bypass Through User-Controlled KeyCVE-2024-38701 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4.
- Product
- Academy LMS
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 6, 2024Academy LMS: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-37234 · WordPress plugins & themes · reported by PatchstackLow 3.5
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kodezen Limited Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4.
- Product
- Academy LMS
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 9, 2024Academy LMS: Missing AuthorizationCVE-2024-32714 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Academy LMS academy.This issue affects Academy LMS: from n/a through 1.9.16.
- Product
- Academy LMS
- Affected
- up to 1.9.16
- What to do
- Affects up to 1.9.16. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024Academy LMS: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35171 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Academy LMS academy.This issue affects Academy LMS: from n/a through 1.9.25.
- Product
- Academy LMS
- Affected
- up to 1.9.25
- What to do
- Affects up to 1.9.25. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 6, 2024Academy LMS: Missing AuthorizationCVE-2024-33912 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 1.9.16.
- Product
- Academy LMS
- Affected
- up to 1.9.16
- What to do
- Affects up to 1.9.16. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2024Academy LMS – eLearning and online course solution for: Privilege escalationCVE-2024-1505 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. This is due to plugin allowing arbitrary user meta updates through the saved_user_info() function. This makes it possible for authenticated attackers, with minimal permissions such as students, to elevate their user role to that of an administrator.
- Product
- Academy LMS – eLearning and online course solution for
- Affected
- up to 1.9.19
- What to do
- Affects up to 1.9.19. Update Academy LMS – eLearning and online course solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.