Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning

Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning has 21 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; 20 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 5.4, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 3 high. 2026 was the busiest year with 12 disclosures.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 7 of the records (33%). Other recurring categories include Missing Authorization, Exposure Of Sensitive Information To An Unauthorized Actor.

20 of the records (95%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

17 independent researchers contributed these findings, most of them (3) reported by Wordfence PRISM.

Strategic Overview

Avg CVSSMedium

5.4/ 10

Patch Coverage95%

Open

Fixed

Get automatic notifications for all Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2026-12376

Academy LMS <= 3.8.2 - Authenticated (Subscriber+) Information Exposure

Read the full analysis

Vulnerability Records

21 records


2026-10-09 14:14	Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id Academy LMS <= 4.0.3	`CVE-2026-104915`	6.5 Medium	Wordfence PRISM	Yes
2026-10-09 00:00	Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint Academy LMS <= 4.0.3	`CVE-2026-104022`	5.4 Medium	Wordfence PRISM	Yes
2026-10-05 00:00	Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference Academy LMS <= 3.0.0	`CVE-2026-104050`	4.3 Medium	Morato Antoine	Yes
2026-10-05 00:00	Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference Academy LMS <= 3.0.0	`CVE-2026-104049`	4.3 Medium	Morato Antoine	Yes
2026-10-02 16:31	Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route Academy LMS <= 4.0.1	`N/A`	4.3 Medium	Wordfence PRISM	Yes
2026-08-04 00:00	Academy LMS <= 3.8.2 - Authenticated (Subscriber+) Information Exposure Academy LMS <= 3.8.2	`CVE-2026-12376`	4.3 Medium	Stefan Spasic	No
2026-07-24 00:00	Academy LMS <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Lesson Content Disclosure Academy LMS <= 3.8.2	`CVE-2026-16563`	4.3 Medium	Pedro Pinho	Yes
2026-07-13 00:00	Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter Academy LMS <= 3.8.0	`CVE-2026-9341`	4.3 Medium	sorawautsukushiii	Yes
2026-07-01 00:00	Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure Academy LMS <= 3.8.1	`CVE-2026-5348`	5.3 Medium	Md. Moniruzzaman Prodhan (NomanProdhan)	Yes
2026-06-30 00:00	Academy LMS <= 3.8.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Note/Progress Modification Academy LMS <= 3.8.0	`CVE-2026-14184`	4.3 Medium	Mustafa Ahmed	Yes

Showing 1–10 of 21 reports