WordPress plugin
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical1
- High3
- Medium16
- Low1
All Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | Unauthenticated Privilege Escalation via Account Takeover ≤3.5.0Update to 3.5.1 | CVE-2025-15521 | |
| High7.2 | Authenticated (Administrator+) PHP Object Injection via 'import_all_courses' ≤3.3.8Update to 3.3.9 | CVE-2025-12099 | |
| High8.3 | Open Redirect ≤2.0.10Update to 2.0.11 | CVE-2024-37234 | |
| High8.8 | Authenticated (Subscriber+) Privilege Escalation ≤1.9.19Update to 1.9.20 | CVE-2024-1505 |
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
≤3.5.0Update to 3.5.1
- High7.2Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'
≤3.3.8Update to 3.3.9
- High8.3Open Redirect
≤2.0.10Update to 2.0.11
- High8.8Authenticated (Subscriber+) Privilege Escalation
≤1.9.19Update to 1.9.20
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning: common questions
Does Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning have known vulnerabilities?
Yes. VulnCrest Radar lists 21 known vulnerabilities in Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning: 1 critical, 3 high, 16 medium, 1 low. At least one is not fixed in the latest version.
How do I check which version of Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning vulnerability?
CVE-2026-104915, published Oct 9, 2026: Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id. Severity: Medium (CVSS 6.5).
Is any Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning vulnerability listed in CISA KEV?
No. None of the known Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning vulnerabilities is currently listed in the CISA KEV catalog.