The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student (Subscriber-level) account to disclose the content of arbitrary lessons, including lessons of paid courses they are not enrolled in and unpublished (draft, pending, private) lessons.
The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above to read every user's quiz attempts across the whole site, including personal data such as IP addresses, names, registration dates, and quiz results. This vulnerability has a CVSS score of 4.3 and MEDIUM severity. The CVE reco [truncated]
