CVE-2026-104915 kodezen CVE debrief

Who should care

Defenders managing WordPress installations with the Academy LMS plugin, especially those with custom-level users, should assess exposure and prioritize remediation. This involves verifying the version of the plugin, restricting access to sensitive functions, and monitoring for suspicious activity. Additionally, defenders should implement compensating controls for exposed systems and review relevant logs to ensure the security of their environments. Priorit

Why it matters

The Academy LMS plugin for WordPress is vulnerable to authorization bypass, allowing authenticated attackers with custom-level access to delete arbitrary Academy lesson comments and their replies across courses they do not instruct. Defenders should verify and remediate this vulnerability, especially those managing WordPress installations with custom-level users.

• Authenticated attackers can delete arbitrary lesson comments and their replies across courses they do not instruct
• Requires verification of user authorization for comment deletion
• Custom-level users can exploit this vulnerability
• Remediation priority for WordPress installations with Academy LMS plugin

Technical summary

The Academy LMS plugin for WordPress is vulnerable to authorization bypass due to improper verification of user authorization. This allows authenticated attackers with custom-level access and above to permanently delete arbitrary Academy lesson comments and their replies authored by any user, including administrators, across courses they do not instruct by supplying their own course_id to pass the instructor check. The vulnerability exists in Academy LMS plugin versions up to and including 4.0.3. Authenticated attackers can exploit this by targeting comments belonging to entirely different courses, highlighting the need for defenders to verify and remediate this vulnerability, especially those managing WordPres

Defensive priority

Medium priority for defenders to verify and remediate this vulnerability, especially those managing WordPress installations with the Academy LMS plugin.

Recommended defensive actions

• Verify the version of the Academy LMS plugin and update to a patched version if necessary.
• Restrict access to the delete_lesson_comment AJAX function.
• Monitor for suspicious activity related to comment deletion.
• Implement additional authentication and authorization checks for custom-level users.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in Academy LMS plugin versions up to and including 4.0.3. Authenticated attackers with custom-level access can delete arbitrary Academy lesson comments and their replies across courses they do not instruct by supplying their own course_id to pass the instructor check.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.