Unauthorized Access Vulnerability in Academy LMS WordPress Plugin
CVE-2026-104049
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 7 October 2026
Badges
What is CVE-2026-104049?
The Academy LMS plugin for WordPress prior to version 4.0.0 contains a vulnerability that fails to adequately verify user enrollment and ownership of course materials when utilizing its REST API. This oversight permits users with self-registerable student accounts to access and retrieve content from lessons, including those from private or paid courses, to which they are not officially enrolled. This can lead to unauthorized disclosure of proprietary educational content, necessitating immediate updates to ensure user permissions are correctly enforced.
Affected Version(s)
Academy LMS 0 < 4.0.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.