CVE-2026-5348: Academy LMS WordPress Plugin IDOR – Unauthorized Curriculum Access

Technical summary

CVE-2026-5348 is an Insecure Direct Object Reference (IDOR) vulnerability in the Academy LMS plugin for WordPress affecting versions up to and including 3.8.1. The '/topics' REST API endpoint is registered with a permission callback configured to '__return_true', which bypasses all permission checks. This allows unauthenticated REST requests to enumerate and retrieve topic/curriculum data for any course ID without verifying the course's post status (published, draft, scheduled, private, password-protected) or validating user enrollment. The vulnerability is a classic implementation flaw where access control logic was either omitted or deliberately bypassed during development.

Business impact

For organizations using Academy LMS to deliver proprietary training, confidential onboarding, or exclusive educational content, this vulnerability enables unauthorized curriculum discovery. Competitors, disgruntled users, or researchers could map out course structure and content hierarchy without permission. This can compromise intellectual property, expose training roadmaps, or reveal internal process documentation embedded in course materials. Institutions relying on course privacy or enrollment gating for competitive advantage or compliance face reputational and operational risk if curriculum leaks. While the vulnerability itself does not allow modification or data destruction, the unauthorized information disclosure can inform secondary attacks or social engineering.

Affected systems

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution is vulnerable in versions up to and including 3.8.1. Any WordPress installation with this plugin active is potentially affected, regardless of hosting model or WordPress configuration. Scope of impact depends on what curriculum data is stored in private or restricted courses; sites using the plugin only for public courses may face lower direct harm, though they still carry unnecessary exposure.

Exploitability

Exploitability is straightforward. The vulnerability requires no authentication, no user interaction, and is accessible over the network. An attacker can craft simple REST API requests to the '/topics' endpoint with varying course IDs to extract curriculum data. No specialized tools or credentials are needed—basic HTTP requests suffice. The primary limiting factor is course ID enumeration; if IDs are sequential or predictable, discovery is trivial. Organizations should assume this vulnerability can be exploited by anyone with network access to the WordPress installation.

Remediation

Upgrade the Academy LMS plugin to a version that corrects the permission callback on the '/topics' REST API endpoint. Verify with the vendor advisory which version includes the fix (3.8.2 or later is likely; confirm before deploying). After patching, verify that the '/topics' endpoint now properly validates user enrollment and course post status before returning data. As an interim mitigation, administrators without immediate access to patches should consider disabling REST API endpoints if not actively used, restricting REST API access by IP, or implementing Web Application Firewall (WAF) rules to block unauthenticated requests to Academy LMS REST endpoints.

Patch guidance

Check the Academy LMS plugin vendor advisory for the specific patched version. Update the plugin via the WordPress admin dashboard once a fixed version is released and tested in a staging environment. If the vendor has not yet released a patch, monitor their security channel (changelog, blog, GitHub security advisories) for an update announcement. After updating, clear any caches and test that private/draft courses remain inaccessible to non-enrolled users via both the web interface and REST API.

Detection guidance

Monitor access logs for requests to REST API endpoints containing '/topics' or '/wp-json/academy/' patterns from unauthenticated sources or unusual user agents. Look for repeated requests with sequential or randomized course ID parameters (e.g., /topics/123, /topics/124). Alert on any successful (HTTP 200) responses to '/topics' requests that originate outside expected client applications. If using WordPress logging plugins, enable REST API request logging and review for suspicious patterns. Network-based detection can flag high-volume or rapid enumeration attempts against these endpoints.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), the vulnerability is straightforward to exploit and affects information confidentiality. For organizations using Academy LMS to protect intellectual property or sensitive training content, this should be treated as a priority because curriculum leaks can expose competitive advantage or internal processes. The lack of authentication and user interaction required makes it practical to exploit at scale. However, organizations using the plugin only for public or low-sensitivity content may deprioritize below critical patches. Consider priority based on the sensitivity of your course materials and whether enrollment gating is a business requirement.

Risk score, explained

The CVSS:3.1 score of 5.3 reflects low attack complexity, no privilege requirement, and no user interaction—all factors that ease exploitation. However, the scope is unchanged (only the vulnerable component is affected) and impact is limited to confidentiality (curriculum data disclosure) with no integrity or availability impact. The score correctly captures that this is a moderate information disclosure risk, not a critical system compromise. Organizations handling highly sensitive training content or intellectual property may internally risk-rate this higher than the base CVSS suggests.

Frequently asked questions