Refine your search

3 vulnerabilities found for Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning by kodezen

CVE-2026-120544 (GCVE-0-2026-120544)
Vulnerability from cvelistv5
Published
2026-11-03 04:43
Modified
2026-11-03 13:22
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Summary
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the attacker-supplied path before reading it, so files with any other extension — including wp-config.php — are out of reach. The file's contents are returned in full in the REST JSON response's content field.
References
Impacted products
Vendor Product Version
kodezen Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning Version: 0   ≤ 4.0.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-120544",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T13:21:59.193506Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T13:22:28.987Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Academy LMS \u2013 AI Course Builder, Quizzes, Certificates \u0026 eLearning",
          "vendor": "kodezen",
          "versions": [
            {
              "lessThanOrEqual": "4.0.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Academy LMS \u2013 AI Course Builder, Quizzes, Certificates \u0026 eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the \u0027id\u0027 parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a \u0027.html\u0027 extension to the attacker-supplied path before reading it, so files with any other extension \u2014 including wp-config.php \u2014 are out of reach. The file\u0027s contents are returned in full in the REST JSON response\u0027s content field."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T04:43:06.575Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1f0a1439-d10c-4dfc-9a40-7319debe3c51?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.1/includes/frontend/template/block.php#L50"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.1/includes/frontend/template/block.php#L30"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.1/includes/frontend/template/block.php#L267"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.1/includes/frontend/template/block.php#L12"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3723396%40academy\u0026new=3723396%40academy"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-30T19:08:36.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-02T16:31:44.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Academy LMS \u003c= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via \u0027id\u0027 Parameter in /wp/v2/templates REST Route"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-120544",
    "datePublished": "2026-11-03T04:43:06.575Z",
    "dateReserved": "2026-11-02T16:23:44.346Z",
    "dateUpdated": "2026-11-03T13:22:28.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104022 (GCVE-0-2026-104022)
Vulnerability from cvelistv5
Published
2026-10-10 02:26
Modified
2026-10-11 16:55
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE
  • CWE-269 - Improper Privilege Management
Summary
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the `add_child()` function calling `add_role('academy_student')` on any existing account resolved from the attacker-supplied `email` parameter before `Store::link()` validates the guardian-ward relationship, and failing to roll back that role write when `Store::link()` returns a `WP_Error`. This makes it possible for authenticated attackers with the `academy_guardian` role or higher to elevate any existing WordPress account — including their own — to the `academy_student` role, gaining `edit_posts` (Contributor-equivalent) capabilities and, when the student file-upload setting is enabled, `upload_files` (Author-equivalent) capabilities not granted to the guardian role. When a guardian supplies their own email address, `email_exists()` resolves to their own user ID, causing `Store::link()` to reject the self-link, but because the `add_role()` call has already executed and is never reversed, the academy_student role grant on their own account persists permanently.
References
Impacted products
Vendor Product Version
kodezen Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning Version: 0   ≤ 4.0.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104022",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T16:39:21.951557Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T16:55:20.564Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Academy LMS \u2013 AI Course Builder, Quizzes, Certificates \u0026 eLearning",
          "vendor": "kodezen",
          "versions": [
            {
              "lessThanOrEqual": "4.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Academy LMS \u2013 AI Course Builder, Quizzes, Certificates \u0026 eLearning plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the `add_child()` function calling `add_role(\u0027academy_student\u0027)` on any existing account resolved from the attacker-supplied `email` parameter before `Store::link()` validates the guardian-ward relationship, and failing to roll back that role write when `Store::link()` returns a `WP_Error`. This makes it possible for authenticated attackers with the `academy_guardian` role or higher to elevate any existing WordPress account \u2014 including their own \u2014 to the `academy_student` role, gaining `edit_posts` (Contributor-equivalent) capabilities and, when the student file-upload setting is enabled, `upload_files` (Author-equivalent) capabilities not granted to the guardian role. When a guardian supplies their own email address, `email_exists()` resolves to their own user ID, causing `Store::link()` to reject the self-link, but because the `add_role()` call has already executed and is never reversed, the academy_student role grant on their own account persists permanently."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T02:26:31.622Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a54dd9e5-59e7-4655-9f64-e198deda1383?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/guardian/rest-api.php#L160"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/guardian/rest-api.php#L138"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/guardian/rest-api.php#L85"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/guardian/store.php#L39"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3734598%40academy\u0026new=3734598%40academy"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-01T17:07:56.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-09T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Academy LMS \u003c= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104022",
    "datePublished": "2026-10-10T02:26:31.622Z",
    "dateReserved": "2026-10-01T17:03:56.186Z",
    "dateUpdated": "2026-10-11T16:55:20.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104915 (GCVE-0-2026-104915)
Vulnerability from cvelistv5
Published
2026-10-10 02:26
Modified
2026-10-11 16:55
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE
Summary
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to permanently delete arbitrary Academy lesson comments and their replies authored by any user, including administrators, across courses they do not instruct. This is exploitable by any user registered as an Academy instructor for at least one course, as they can supply their own course_id to pass the instructor check while targeting comments belonging to entirely different courses.
References
Impacted products
Vendor Product Version
kodezen Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning Version: 0   ≤ 4.0.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104915",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T16:44:01.920159Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T16:55:20.686Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Academy LMS \u2013 AI Course Builder, Quizzes, Certificates \u0026 eLearning",
          "vendor": "kodezen",
          "versions": [
            {
              "lessThanOrEqual": "4.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Academy LMS \u2013 AI Course Builder, Quizzes, Certificates \u0026 eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to permanently delete arbitrary Academy lesson comments and their replies authored by any user, including administrators, across courses they do not instruct. This is exploitable by any user registered as an Academy instructor for at least one course, as they can supply their own course_id to pass the instructor check while targeting comments belonging to entirely different courses."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T02:26:30.717Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2640d1f8-958d-4556-919c-58df5bf15b40?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php#L496"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php#L477"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php#L480"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php#L469"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/classes/abstract-ajax-handler.php#L43"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/traits/courses.php#L380"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3734598%40academy\u0026new=3734598%40academy"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T16:24:48.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-09T14:14:57.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Academy LMS \u003c= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX \u2014 Attacker-Controlled course_id vs. Target comment_id"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104915",
    "datePublished": "2026-10-10T02:26:30.717Z",
    "dateReserved": "2026-10-02T16:09:59.143Z",
    "dateUpdated": "2026-10-11T16:55:20.686Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}