CVE-2024-32714: Academy LMS Auth Bypass Vulnerability

CVE-2024-32714 Overview

CVE-2024-32714 is a missing authorization vulnerability in the Kodezen Academy LMS plugin for WordPress. The flaw affects all versions from initial release through 1.9.16. Authenticated attackers with low-privilege accounts can invoke restricted plugin functionality without passing proper capability checks. The weakness maps to [CWE-862] Missing Authorization and impacts learning management deployments running the plugin on WordPress sites.

Critical Impact
Authenticated users with minimal privileges can bypass access controls to reach functions restricted to instructors or administrators, exposing course data, user records, and site integrity.

Affected Products

Kodezen Academy LMS plugin for WordPress
Academy LMS versions from n/a through 1.9.16
WordPress sites bundling the vulnerable plugin

Discovery Timeline

2024-06-09 - CVE-2024-32714 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32714

Vulnerability Analysis

The Academy LMS plugin exposes plugin actions and REST endpoints that do not verify the caller's capabilities. An authenticated user, including a standard subscriber-level account, can call these endpoints and trigger operations reserved for higher-privileged roles. The plugin relies on the presence of a valid session rather than enforcing role or capability checks per action.

Successful exploitation allows attackers to read, modify, or delete resources managed by the plugin. Depending on the affected function, an attacker can alter course content, manipulate enrollment records, retrieve student data, or change plugin configuration. The attack requires network access to the WordPress site and a low-privileged account, which is trivial to obtain when open registration is enabled.

Root Cause

The root cause is broken access control [CWE-862]. Plugin handlers omit calls to WordPress capability functions such as current_user_can() or equivalent role checks before performing sensitive operations. Authorization logic is either missing entirely or replaced by weaker checks such as a nonce or authenticated-user check, which do not enforce role separation.

Attack Vector

Exploitation occurs over the network against a vulnerable WordPress installation. The attacker authenticates as any low-privileged user and then issues crafted HTTP requests to the plugin's admin-ajax handlers or REST routes. No user interaction from an administrator is required, and the attack completes in a single request. Refer to the Patchstack Vulnerability Advisory for endpoint-level detail.

Detection Methods for CVE-2024-32714

Indicators of Compromise

Unexpected requests from subscriber-level accounts to Academy LMS admin-ajax actions or REST endpoints.
Modification of course records, quiz data, or enrollment tables by non-instructor accounts.
New instructor or administrator accounts created shortly after low-privilege authentication events.
Outbound HTTP traffic from the WordPress host following unauthorized plugin action calls.

Detection Strategies

Review WordPress access logs for POST requests to admin-ajax.php referencing Academy LMS actions from non-privileged user IDs.
Correlate WordPress audit logs with database changes to LMS tables authored by unexpected user roles.
Alert on privilege changes and role promotions occurring outside administrator sessions.

Monitoring Recommendations

Enable a WordPress activity log plugin that records user role, IP, and endpoint for every plugin action.
Forward web server and application logs to a central SIEM for role-versus-action anomaly detection.
Monitor plugin version inventory across all managed WordPress sites and flag installations at or below 1.9.16.

How to Mitigate CVE-2024-32714

Immediate Actions Required

Update the Academy LMS plugin to a version newer than 1.9.16 on all WordPress instances.
Audit existing user accounts and remove untrusted or unused low-privilege users.
Disable open user registration until the plugin is patched if registration is not required.
Review recent LMS data changes and revert unauthorized modifications identified in logs.

Patch Information

Kodezen has addressed the missing authorization checks in Academy LMS releases after version 1.9.16. Site operators should apply the latest available plugin release from the WordPress plugin repository. Confirmation and version guidance are available in the Patchstack Vulnerability Advisory.

Workarounds

Restrict access to /wp-admin/admin-ajax.php and the plugin's REST routes using a web application firewall rule that filters by user role.
Temporarily deactivate the Academy LMS plugin on sites where a patch cannot be applied immediately.
Enforce strong password policies and multi-factor authentication to reduce the pool of exploitable low-privilege accounts.

bash

# Configuration example: update the plugin via WP-CLI
wp plugin update academy --version=latest
wp plugin list --name=academy --fields=name,status,version