WordPress plugin
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical1
- High3
- Medium16
- Low1
All Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning vulnerabilities
- Medium6.5Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id
≤4.0.3Update to 4.0.4
- Medium5.4Authenticated (Custom+) Privilege Escalation to add_child REST endpoint
≤4.0.3Update to 4.0.4
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤3.0.0Update to 4.0.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤3.0.0Update to 4.0.0
- Medium4.3Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route
≤4.0.1Update to 4.0.2
- Medium4.3Authenticated (Subscriber+) Information Exposure
≤3.8.2No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Lesson Content Disclosure
≤3.8.2Update to 3.8.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter
≤3.8.0Update to 3.8.1
- Medium5.3Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure
≤3.8.1Update to 3.8.2
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Note/Progress Modification
≤3.8.0Update to 3.8.1
- Medium4.3Missing Authorization
≤3.5.3Update to 3.5.4
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
≤3.5.0Update to 3.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.4.0Update to 3.4.1
- High7.2Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'
≤3.3.8Update to 3.3.9
- Medium4.3Authenticated (Academy Instructor+) Insecure Direct Object Reference
≤3.3.4Update to 3.3.5
- Low2.7Missing Authorization
≤2.0.4Update to 2.0.5
- High8.3Open Redirect
≤2.0.10Update to 2.0.11
- Medium5.3Unauthenticated Sensitive Information Exposure
≤1.9.25Update to 1.9.26
- Medium4.3Missing Authorization
≤1.9.16Update to 1.9.17
- Medium5.4Missing Authorization
≤1.9.16Update to 1.9.17
- High8.8Authenticated (Subscriber+) Privilege Escalation
≤1.9.19Update to 1.9.20
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning: common questions
Does Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning have known vulnerabilities?
Yes. VulnCrest Radar lists 21 known vulnerabilities in Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning: 1 critical, 3 high, 16 medium, 1 low. At least one is not fixed in the latest version.
How do I check which version of Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning vulnerability?
CVE-2026-104915, published Oct 9, 2026: Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id. Severity: Medium (CVSS 6.5).
Is any Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning vulnerability listed in CISA KEV?
No. None of the known Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning vulnerabilities is currently listed in the CISA KEV catalog.