CVE-2026-14184
Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as completed.
| Vendor | unknown |
| Product | academy lms |
| Published | Jul 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown academy lms
Be the first to know when new unknown vulnerabilities affecting unknown academy lms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Academy LMS
0 < 3.8.1
References
Credits
Mustafa Ahmed WPScan