Insecure API Access in Academy LMS Plugin for WordPress
CVE-2026-16563
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 3 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16563?
The Academy LMS WordPress plugin versions before 3.8.3 contains a vulnerability where the REST API does not properly verify course enrollment or status of lesson publication. This oversight allows users with a Subscriber-level account to access the content of lessons they are not enrolled in. This includes lessons that are part of paid courses and those that are unpublished, posing a significant risk to sensitive educational content.
Affected Version(s)
Academy LMS 0 < 3.8.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.