Privilege Escalation in Academy LMS Plugin for WordPress

CVE-2026-104022

What is CVE-2026-104022?

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is susceptible to a privilege escalation issue. This occurs when the add_child() function improperly handles the add_role('academy_student') command based on an attacker-supplied email parameter before the guardian's relationship is validated. As a result, authenticated users with the academy_guardian role can elevate any user's WordPress account—including their own—to the academy_student role, thereby granting them editing capabilities that should not be available to their role. The vulnerability is further exacerbated when guardians use their own email addresses, as the system's controls fail to prevent the escalation, leaving it unaddressed permanently.

References