These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Academy LMS plugin for WordPress, versions up to and including 4.0.3, is vulnerable to authorization bypass. This vulnerability allows authenticated attackers with custom-level access to delete arbitrary Academy lesson comments and their replies across courses they do not instruct. The plugin fails to properly verify user authorization for comment deletion, enabling attackers to supply their own cours [truncated]
CVE-2026-104022 is a Privilege Escalation vulnerability in Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress. Authenticated attackers with the `academy_guardian` role or higher can elevate any existing WordPress account to the `academy_student` role, gaining `edit_posts` and potentially `upload_files` capabilities.
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference. Authenticated attackers with Subscriber-level access can read, overwrite, or delete private lesson notes and falsify lesson-completion progress. This vulnerability affects users with Subscriber-level access and above. The CVSS score is 4.3, indicating a Medium severity.
The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data and disclosure of sensitive information due to missing capability checks on multiple AJAX actions in all versions up to, and including, 2.4.0. This vulnerability allows authenticated attackers, with subscriber level access and above, to read sensitive configuration data and plugin settings, inc [truncated]