CVE-2026-12376 Academy LMS CVE debrief

Who should care

Site administrators using the Academy LMS WordPress plugin, security teams monitoring for vulnerabilities in WordPress plugins, and users concerned about data privacy should be aware of this vulnerability. They should review their systems for affected versions, restrict access to quiz attempt records, and implement compensating controls to protect sensitive data.

Technical summary

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above to read every user's quiz attempts across the whole site. This includes personal data such as IP addresses, names, registration dates, and quiz results. The vulnerability has a CVSS score of 4.3 and MEDIUM severity. The plugin's lack of access control enables unauthorized users to access sensitive information, potentially leading to data breaches and privacy violations. Defenders should verify affected systems, review official advisories, and monitor for unauthorized access to quiz attempts and personal data.

Defensive priority

Authenticated users with subscriber-level access may be able to read quiz attempts across the site, including personal data.

Recommended defensive actions

• Inventory affected systems using the Academy LMS WordPress plugin version 3.8.2 or earlier.
• Restrict access to quiz attempt records to their owner.
• Monitor for unauthorized access to quiz attempts and personal data.
• Implement compensating controls to protect sensitive data.
• Verify vendor remediation and apply patches.
• Review security configurations and ensure proper access controls are in place.
• Track exceptions and retest remediated assets to ensure vulnerability resolution.

Evidence notes

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner. Official records indicate CVE-2026-12376 has a CVSS score of 4.3 and MEDIUM severity. The vulnerability allows any authenticated user with subscriber-level access and above to read every user's quiz attempts across the whole site, including personal data such as IP addresses, names, registration dates, and quiz results. Defenders should verify affected systems, review official advisories, and monitor for unauthorized access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.