PatchSiren

Academy LMS CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Academy LMS CVE published 2026-07-31

CVE-2026-12376

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above to read every user's quiz attempts across the whole site, including personal data such as IP addresses, names, registration dates, and quiz results. This vulnerability has a CVSS score of 4.3 and MEDIUM severity. The CVE reco [truncated]