Academy LMS – WordPress LMS Plugin for Complete eLearning Solution Security & Risk Analysis

The "academy" v3.6.0 plugin exhibits a mixed security posture. While it demonstrates good practices like a high percentage of prepared SQL statements and proper output escaping, significant concerns arise from its attack surface and historical vulnerability patterns.

The static analysis reveals a substantial attack surface of 45 entry points, with 3 AJAX handlers lacking authentication checks. This is a direct pathway for attackers to potentially exploit vulnerabilities without proper authorization. Furthermore, the presence of two instances of the `unserialize` function, coupled with two high-severity taint analysis flows with unsanitized paths, indicates a potential risk of deserialization vulnerabilities. The plugin also bundles the TCPDF library, which, if outdated or vulnerable, could introduce additional risks.

The plugin's vulnerability history is a major red flag. With 11 known CVEs, including a past critical vulnerability and several high-severity ones, it suggests a recurring pattern of security weaknesses. The common vulnerability types like Missing Authorization, XSS, and Deserialization of Untrusted Data reinforce these concerns. Although there are currently no unpatched CVEs, the frequency and nature of past vulnerabilities necessitate caution and proactive security management.