CVE-2024-38701: Academy LMS Auth Bypass Vulnerability

CVE-2024-38701 Overview

CVE-2024-38701 is an Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in the Kodezen Academy LMS plugin for WordPress. The flaw affects all versions up to and including 2.0.4. Authenticated attackers with low-level privileges can manipulate user-controlled identifiers to access or modify resources belonging to other users. The issue is classified as broken access control, allowing horizontal or vertical privilege escalation across the learning management platform.

Critical Impact
An authenticated attacker can bypass authorization checks over the network to compromise confidentiality, integrity, and availability of learner and course data managed by Academy LMS.

Affected Products

Kodezen Academy LMS plugin for WordPress
All versions from n/a through 2.0.4
WordPress sites running the vulnerable plugin build

Discovery Timeline

2024-07-22 - CVE-2024-38701 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38701

Vulnerability Analysis

The vulnerability resides in Academy LMS plugin request handlers that accept a user-supplied identifier and act on the referenced object without verifying ownership. An authenticated user can substitute another user's identifier in a request parameter and receive or modify data that should be restricted. The flaw enables cross-account data access within the learning management system, including course enrollments, profile fields, and related records. Because the plugin runs inside WordPress, exploitation grants attackers a foothold to pivot toward other users, instructors, and course content.

Root Cause

The root cause is the plugin's reliance on user-controlled keys, such as numeric object identifiers passed in HTTP parameters, to select records without performing an authorization check that ties the request to the current session. This pattern maps directly to [CWE-639] Authorization Bypass Through User-Controlled Key, commonly known as Insecure Direct Object Reference (IDOR).

Attack Vector

Exploitation requires network access to the WordPress site and low-privilege authenticated access, such as a standard student account. The attacker sends a crafted HTTP request to a vulnerable Academy LMS endpoint and substitutes the object identifier of a target user or resource. The server processes the request without validating ownership, returning or modifying data belonging to another account. No user interaction is required, and attack complexity is low.

No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2024-38701

Indicators of Compromise

Unexpected changes to user profiles, course enrollments, or grades in the Academy LMS database made by accounts that do not own the affected records.
HTTP requests from authenticated low-privilege users containing sequential or enumerated identifier parameters targeting Academy LMS endpoints.
Access log entries showing a single authenticated session accessing many distinct user or resource identifiers within a short window.

Detection Strategies

Review web server and WordPress request logs for repeated calls to Academy LMS AJAX or REST endpoints where identifier parameters vary while the session cookie remains constant.
Correlate WordPress user roles with the identifiers they access; alert when a subscriber-level account operates on records owned by other users.
Compare Academy LMS plugin version metadata against the fixed release to identify unpatched WordPress installations.

Monitoring Recommendations

Enable verbose access logging on the WordPress front controller and forward logs to a centralized analytics platform for identifier-parameter analysis.
Monitor database write activity on Academy LMS tables for updates issued by user contexts that do not match the record owner.
Track authentication events and follow up on accounts that generate abnormal volumes of enrollment, profile, or course modification requests.

How to Mitigate CVE-2024-38701

Immediate Actions Required

Update the Academy LMS plugin to a version later than 2.0.4 as soon as a fixed release is available from Kodezen.
Audit existing Academy LMS user accounts and revoke any that show signs of unauthorized access to other users' data.
Restrict registration on WordPress sites running Academy LMS to reduce the pool of low-privilege accounts that could exploit the flaw.

Patch Information

Consult the Patchstack Vulnerability Report for the latest patch status and vendor guidance. Apply the vendor-supplied update through the WordPress plugin manager once available, and verify the installed version afterward.

Workarounds

Temporarily disable the Academy LMS plugin on sites that cannot be patched immediately, especially those with open user registration.
Deploy a Web Application Firewall (WAF) rule that blocks requests to Academy LMS endpoints when identifier parameters do not match the authenticated user's identity.
Limit access to the WordPress site with IP allowlisting or authentication gateways while remediation is pending.

bash

# Configuration example
# Check installed Academy LMS plugin version on a WordPress host
wp plugin get academy --field=version

# Disable the plugin as a temporary workaround
wp plugin deactivate academy