CVE-2026-16563 Academy LMS CVE debrief

Who should care

Users of the Academy LMS WordPress plugin, particularly those with sensitive course content, should verify their plugin version and take defensive actions to prevent unauthorized access. This includes updating to version 3.8.3 or later, verifying course enrollment checks, and validating lesson publication status in API responses. Additionally, users should monitor for suspicious API activity and restrict access to sensitive course content.

Technical summary

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API. This allows users with a self-service student (Subscriber-level) account to disclose the content of arbitrary lessons, including lessons of paid courses they are not enrolled in and unpublished (draft, pending, private) lessons. The plugin's REST API does not implement proper access controls, leading to potential unauthorized access to sensitive course content.

Defensive priority

Verify course enrollment and lesson publication checks in Academy LMS plugin REST API

Recommended defensive actions

• Verify course enrollment checks in Academy LMS plugin REST API
• Validate lesson publication status in API responses
• Restrict access to sensitive course content
• Monitor for suspicious API activity
• Update Academy LMS plugin to version 3.8.3 or later

Evidence notes

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student (Subscriber-level) account to disclose the content of arbitrary lessons, including lessons of paid courses they are not enrolled in and unpublished (draft, pending, private) lessons. Evidence from WPScan indicates vulnerability in Academy LMS WordPress plugin before 3.8.3; official CVE and NVD records provide additional context. WPScan's research highlights the importance of verifying course enrollment and lesson publication checks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.