Directory Traversal Vulnerability in Academy LMS WordPress Plugin

CVE-2026-120544

What is CVE-2026-120544?

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is susceptible to a directory traversal vulnerability in all versions up to and including 4.0.1, which can be exploited through the 'id' parameter. Authenticated attackers with contributor-level access or higher can leverage this vulnerability to gain unauthorized access to arbitrary .html files stored on the server. While the plugin restricts access by appending a '.html' extension to the input path, this does not mitigate the risk entirely, as sensitive files may still be exposed through carefully crafted requests. The contents of these files are returned in the REST JSON response, potentially revealing critical information and compromising site security. Website administrators are urged to review and update their installations promptly to mitigate this risk.

References