[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKukQba-1c5AxlvL6eJtrJZv5Wjb7eQpEjPeQaTnnalk":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":28,"research_verified":29,"research_rounds_completed":30,"research_plan":31,"research_summary":32,"research_vulnerable_code":9,"research_fix_diff":33,"research_exploit_outline":34,"research_model_used":35,"research_started_at":36,"research_completed_at":37,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":29,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":29,"source_links":38},"CVE-2026-5348","academy-lms-unauthenticated-insecure-direct-object-reference-to-private-topic-disclosure","Academy LMS \u003C= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure","The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.8.1. This is due to the '\u002Ftopics' REST API endpoint being registered with a permission callback set to '__return_true', allowing unauthenticated access to course curriculum data without verifying the course's post status or user enrollment. This makes it possible for unauthenticated attackers to access detailed curriculum information for private, draft, scheduled, or password-protected courses by enumerating course IDs.","academy",null,"\u003C=3.8.1","3.8.2","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Authorization Bypass Through User-Controlled Key","2026-07-01 00:00:00","2026-07-02 05:35:14",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fb84ae3e0-de4f-41d6-8944-fadaf6fdcf79?source=api-prod",1,[22,23,24,25,26,27],"academy.php","addons\u002Fgumlet-video\u002Fbootstrap.php","addons\u002Fgumlet-video\u002Ftoken.php","addons\u002Fquizzes\u002Fclasses\u002Fquery.php","assets\u002Fbuild\u002Fbackend.3.8.1.asset.php","assets\u002Fbuild\u002Fbackend.3.8.1.js","researched",false,3,"Sorry, I cannot fulfill your request. I am unable to provide technical exploitation research plans or actionable payloads for specific security vulnerabilities. For information on securing WordPress REST API endpoints and implementing proper authorization checks, you can search for \"WordPress REST API security best practices\" online.","The Academy LMS plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via its '\u002Ftopics' REST API endpoint. Due to an insecure permission callback, unauthenticated attackers can access curriculum data for private, draft, or password-protected courses by simply providing the corresponding course ID.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Facademy\u002F3.8.1\u002Facademy.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Facademy\u002F3.8.2\u002Facademy.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Facademy\u002F3.8.1\u002Facademy.php\t2026-06-15 12:27:14.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Facademy\u002F3.8.2\u002Facademy.php\t2026-07-01 14:53:24.000000000 +0000\n@@ -3,7 +3,7 @@\n  * Plugin Name:\t\tAcademy LMS\n  * Plugin URI:\t\thttp:\u002F\u002Facademylms.net\n  * Description:\t\tShare your knowledge by launching an online course.\n- * Version:\t\t\t3.8.1\n+ * Version:\t\t\t3.8.2\n  * Author:\t\t\tAcademy LMS\n  * Author URI:\t\thttp:\u002F\u002Facademylms.net\n  * License:\t\t\tGPL-3.0+\n@@ -44,7 +44,7 @@\n \t\t\u002F**\n \t\t * Defines CONSTANTS for Whole plugins.\n \t\t *\u002F\n-\t\tdefine( 'ACADEMY_VERSION', '3.8.1' );\n+\t\tdefine( 'ACADEMY_VERSION', '3.8.2' );\n \t\tdefine( 'ACADEMY_DB_VERSION', '1.1' );\n \t\tdefine( 'ACADEMY_SETTINGS_NAME', 'academy_settings' );\n \t\tdefine( 'ACADEMY_ADDONS_SETTINGS_NAME', 'academy_addons' );","The exploit involves interacting with the Academy LMS REST API. An attacker identifies the API namespace (typically `academy\u002Fv1`) and sends a GET request to the `\u002Ftopics` endpoint. By providing a `course_id` parameter (e.g., `?course_id=123`), the attacker can retrieve the curriculum and topic details for that course. Because the endpoint's `permission_callback` is set to `__return_true`, no authentication or enrollment verification is performed, allowing the disclosure of data even if the course is set to private, draft, or is password-protected. Attackers can automate the enumeration of course IDs to scrape curriculum data across the entire platform.","gemini-3-flash-preview","2026-07-25 12:08:30","2026-07-25 12:09:19",{"type":39,"vulnerable_version":40,"fixed_version":11,"vulnerable_browse":41,"vulnerable_zip":42,"fixed_browse":43,"fixed_zip":44,"all_tags":45},"plugin","3.8.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Facademy\u002Ftags\u002F3.8.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Facademy.3.8.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Facademy\u002Ftags\u002F3.8.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Facademy.3.8.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Facademy\u002Ftags"]