CVE-2024-33912: Academy LMS Auth Bypass Vulnerability

CVE-2024-33912 Overview

CVE-2024-33912 is a missing authorization vulnerability [CWE-862] in the Kodezen Academy LMS plugin for WordPress. The flaw affects all versions up to and including 1.9.16. It allows authenticated users with low privileges to access paid course content and functionality without proper authorization checks. Patchstack tracks this as a broken access control issue on paid courses.

Critical Impact
An authenticated attacker with low privileges can bypass access controls on paid courses, compromising confidentiality, integrity, and availability of learning content and associated data.

Affected Products

Kodezen Academy LMS WordPress plugin versions through 1.9.16
WordPress installations using the vulnerable Academy LMS plugin
E-learning sites monetizing paid course content via Academy LMS

Discovery Timeline

2024-05-06 - CVE-2024-33912 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33912

Vulnerability Analysis

Academy LMS fails to enforce authorization checks on endpoints that serve paid course resources. The plugin exposes course actions to authenticated users without verifying whether the current user has purchased or been granted access to the requested course. This breaks the paywall model that separates enrolled students from unauthenticated or non-paying users.

The issue is classified as Missing Authorization under [CWE-862]. The attack requires network access and low-level authentication, such as a standard WordPress subscriber account. No user interaction is required to trigger the flaw. Successful exploitation impacts confidentiality of course materials, integrity of enrollment state, and availability of instructor-managed resources.

Root Cause

The root cause is the absence of capability or ownership verification before privileged operations. Vulnerable request handlers proceed to course logic without calling a permission check function that validates whether the requester has purchased the course or holds an appropriate role.

Attack Vector

An attacker registers or authenticates as a low-privileged WordPress user. The attacker then issues HTTP requests directly to Academy LMS plugin endpoints associated with paid course content or enrollment actions. Because the endpoints do not verify authorization, the server returns protected content or performs actions reserved for paying students. See the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-33912

Indicators of Compromise

Access log entries showing subscriber-level accounts requesting paid course endpoints exposed by the Academy LMS plugin
Unexpected enrollment records or course-progress entries for users with no purchase history
Requests to admin-ajax.php or REST routes referencing Academy LMS actions from low-privileged users

Detection Strategies

Audit WordPress user activity for accounts accessing premium course content without matching order or transaction records
Correlate HTTP request logs with the plugin version to identify sites still running Academy LMS 1.9.16 or earlier
Review WordPress database tables used by Academy LMS for enrollment entries that lack a corresponding payment record

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward events to a centralized SIEM for correlation
Alert on spikes of authenticated requests to Academy LMS endpoints from newly registered accounts
Monitor for privilege discrepancies between user role and accessed course resources

How to Mitigate CVE-2024-33912

Immediate Actions Required

Update the Academy LMS plugin to a version later than 1.9.16 as soon as a fixed release is available from Kodezen
Restrict new user registration on affected WordPress sites until the plugin is patched
Review recent enrollments and revoke access granted without valid payment records

Patch Information

Refer to the Patchstack Vulnerability Report for patch availability and the fixed version. Administrators should apply the vendor update through the WordPress plugin dashboard and verify the installed version after the upgrade.

Workarounds

Disable the Academy LMS plugin if a patched version is not yet available and paid course content is at risk
Deploy a web application firewall rule to block unauthenticated and subscriber-level requests to Academy LMS course action endpoints
Temporarily set new WordPress registrations to require manual administrator approval to limit exposure

bash

# Verify installed Academy LMS plugin version via WP-CLI
wp plugin get academy --field=version

# Update the plugin once a fixed release is available
wp plugin update academy