Authorization Bypass Vulnerability in Academy LMS eLearning Plugin for WordPress

CVE-2026-104915

What is CVE-2026-104915?

The Academy LMS plugin for WordPress is vulnerable to an authorization bypass that allows authenticated users with a minimum custom-level access to delete lesson comments and replies from any course they do not teach. The vulnerability arises from inadequate user verification, enabling an attacker to exploit the system by manipulating course IDs to bypass controls. As a result, attackers can permanently remove content across the platform, potentially disrupting the learning experience and compromising administrator-level content.

References