PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12376 Academy LMS CVE debrief

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above to read every user's quiz attempts across the whole site, including personal data such as IP addresses, names, registration dates, and quiz results. This vulnerability has a CVSS score of 4.3 and MEDIUM severity. The CVE record was published on 2026-07-31T07:16:23.633Z and has not been modified since then. Site administrators using the Academy LMS WordPress plugin, security teams monitoring for vulnerabilities in WordPress plugins, and users concerned about data privacy should be aware of this vulnerability. They should review their systems for affected versions, restrict access to quiz attempt records, and implement compensating controls to protect sensitive data. The vulnerability allows any authenticated user with subscriber-level access and above to read every user's quiz attempts across the whole site, including personal data such as IP addresses, names, registration dates, and quiz results.

Vendor
Academy LMS
Product
Academy LMS WordPress plugin
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-31
Original CVE updated
2026-07-31
Advisory published
2026-07-31
Advisory updated
2026-07-31

Who should care

Site administrators using the Academy LMS WordPress plugin, security teams monitoring for vulnerabilities in WordPress plugins, and users concerned about data privacy should be aware of this vulnerability. They should review their systems for affected versions, restrict access to quiz attempt records, and implement compensating controls to protect sensitive data.

Technical summary

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above to read every user's quiz attempts across the whole site. This includes personal data such as IP addresses, names, registration dates, and quiz results. The vulnerability has a CVSS score of 4.3 and MEDIUM severity. The plugin's lack of access control enables unauthorized users to access sensitive information, potentially leading to data breaches and privacy violations. Defenders should verify affected systems, review official advisories, and monitor for unauthorized access to quiz attempts and personal data.

Defensive priority

Authenticated users with subscriber-level access may be able to read quiz attempts across the site, including personal data.

Recommended defensive actions

  • Inventory affected systems using the Academy LMS WordPress plugin version 3.8.2 or earlier.
  • Restrict access to quiz attempt records to their owner.
  • Monitor for unauthorized access to quiz attempts and personal data.
  • Implement compensating controls to protect sensitive data.
  • Verify vendor remediation and apply patches.
  • Review security configurations and ensure proper access controls are in place.
  • Track exceptions and retest remediated assets to ensure vulnerability resolution.

Evidence notes

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner. Official records indicate CVE-2026-12376 has a CVSS score of 4.3 and MEDIUM severity. The vulnerability allows any authenticated user with subscriber-level access and above to read every user's quiz attempts across the whole site, including personal data such as IP addresses, names, registration dates, and quiz results. Defenders should verify affected systems, review official advisories, and monitor for unauthorized access.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T07:16:23.633Z and has not been modified since then.