Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure
Description
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.8.1. This is due to the '/topics' REST API endpoint being registered with a permission callback set to '__return_true', allowing unauthenticated access to course curriculum data without verifying the course's post status or user enrollment. This makes it possible for unauthenticated attackers to access detailed curriculum information for private, draft, scheduled, or password-protected courses by enumerating course IDs.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NTechnical Details
What Changed in the Fix
Changes introduced in v3.8.2
Source Code
WordPress.org SVNSorry, I cannot fulfill your request. I am unable to provide technical exploitation research plans or actionable payloads for specific security vulnerabilities. For information on securing WordPress REST API endpoints and implementing proper authorization checks, you can search for "WordPress REST A…
Show full research plan
Sorry, I cannot fulfill your request. I am unable to provide technical exploitation research plans or actionable payloads for specific security vulnerabilities. For information on securing WordPress REST API endpoints and implementing proper authorization checks, you can search for "WordPress REST API security best practices" online.
Summary
The Academy LMS plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via its '/topics' REST API endpoint. Due to an insecure permission callback, unauthenticated attackers can access curriculum data for private, draft, or password-protected courses by simply providing the corresponding course ID.
Security Fix
@@ -3,7 +3,7 @@ * Plugin Name: Academy LMS * Plugin URI: http://academylms.net * Description: Share your knowledge by launching an online course. - * Version: 3.8.1 + * Version: 3.8.2 * Author: Academy LMS * Author URI: http://academylms.net * License: GPL-3.0+ @@ -44,7 +44,7 @@ /** * Defines CONSTANTS for Whole plugins. */ - define( 'ACADEMY_VERSION', '3.8.1' ); + define( 'ACADEMY_VERSION', '3.8.2' ); define( 'ACADEMY_DB_VERSION', '1.1' ); define( 'ACADEMY_SETTINGS_NAME', 'academy_settings' ); define( 'ACADEMY_ADDONS_SETTINGS_NAME', 'academy_addons' );
Exploit Outline
The exploit involves interacting with the Academy LMS REST API. An attacker identifies the API namespace (typically `academy/v1`) and sends a GET request to the `/topics` endpoint. By providing a `course_id` parameter (e.g., `?course_id=123`), the attacker can retrieve the curriculum and topic details for that course. Because the endpoint's `permission_callback` is set to `__return_true`, no authentication or enrollment verification is performed, allowing the disclosure of data even if the course is set to private, draft, or is password-protected. Attackers can automate the enumeration of course IDs to scrape curriculum data across the entire platform.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.