Insecure Direct Object Reference in Academy LMS Plugin for WordPress

CVE-2026-9341

What is CVE-2026-9341?

The Academy LMS Plugin for WordPress is susceptible to an Insecure Direct Object Reference vulnerability across all versions up to and including 3.8.0. This issue arises from the lack of adequate validation on user-controlled parameters in AJAX handlers like 'save_lesson_note', 'get_lesson_note', and 'complete_lesson_video'. As a result, authenticated attackers with Subscriber-level access or higher can potentially manipulate data, allowing them to read, modify, or erase private lesson notes belonging to other users, even administrators. Additionally, they can misleadingly alter lesson-completion statuses for any user, posing a significant threat to the integrity of user data.

References