CVE-2025-59562: Academy LMS Auth Bypass Vulnerability

CVE-2025-59562 Overview

CVE-2025-59562 is an Insecure Direct Object Reference (IDOR) vulnerability in the Kodezen LLC Academy LMS plugin for WordPress. The flaw is categorized under [CWE-639: Authorization Bypass Through User-Controlled Key] and affects all versions up to and including 3.3.4. Authenticated attackers with high privileges can manipulate user-controlled identifiers to access or affect resources belonging to other users. The vulnerability was published to the National Vulnerability Database on September 22, 2025, and is tracked through Patchstack's advisory database.

Critical Impact
Authenticated attackers can bypass access control checks by tampering with object identifiers, leading to confidentiality loss and availability impact against the Academy LMS platform.

Affected Products

Kodezen LLC Academy LMS plugin for WordPress
Academy LMS versions from initial release through 3.3.4
WordPress sites using the Academy LMS plugin for course delivery

Discovery Timeline

2025-09-22 - CVE CVE-2025-59562 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2025-59562

Vulnerability Analysis

The vulnerability resides in access control logic within the Academy LMS plugin. Request handlers accept object identifiers supplied by the client without verifying that the authenticated user owns or has permission to interact with the referenced resource. This pattern defines an Insecure Direct Object Reference condition.

An authenticated user can substitute identifiers in requests to reach resources assigned to other accounts. The impact profile indicates that confidentiality of data is affected and that resource availability can be disrupted. Integrity remains intact, which suggests the vulnerable endpoints disclose or delete data rather than modify arbitrary records.

The EPSS probability stands at 0.359% as of October 20, 2026, placing exploitation likelihood in a low range. No public proof-of-concept code or exploitation activity has been documented, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing or incorrectly configured server-side authorization checks on endpoints that process user-supplied object identifiers. The plugin trusts the identifier parameter to determine the target resource without re-validating that the current session has rights to that resource. See the Patchstack Vulnerability Report for the specific endpoint details.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated session with elevated privileges. The attacker modifies identifier parameters in HTTP requests to the plugin and observes whether the server returns or acts on resources outside the attacker's own scope. No user interaction is required to complete the attack chain.

Detection Methods for CVE-2025-59562

Indicators of Compromise

HTTP requests to Academy LMS endpoints containing sequential or enumerated identifier parameters from a single authenticated session
Unexpected access to course, enrollment, or user profile objects by accounts that do not own those resources
Elevated error rates or 200-status responses on object retrieval endpoints following parameter tampering

Detection Strategies

Review WordPress access logs for authenticated requests to Academy LMS routes with abnormal identifier ranges
Correlate session identity with the resource identifiers accessed to flag cross-tenant retrieval patterns
Deploy web application firewall rules that inspect plugin endpoints for identifier enumeration behavior

Monitoring Recommendations

Enable verbose logging on the Academy LMS plugin and forward events to a centralized analytics platform
Alert on administrative or instructor accounts accessing resources outside their assigned courses
Monitor the plugin version string across managed WordPress instances to confirm patched builds are deployed

How to Mitigate CVE-2025-59562

Immediate Actions Required

Identify all WordPress sites running Academy LMS version 3.3.4 or earlier and schedule an upgrade
Restrict high-privilege plugin accounts to trusted operators and rotate credentials for shared instructor roles
Audit recent plugin activity for signs of unauthorized object access using WordPress and web server logs

Patch Information

Consult the Patchstack Vulnerability Report for the fixed release and remediation guidance from Kodezen LLC. Apply the vendor-supplied update that addresses versions above 3.3.4.

Workarounds

Temporarily disable the Academy LMS plugin on sites where immediate patching is not feasible
Place the plugin's endpoints behind a web application firewall rule that blocks parameter tampering patterns
Limit account creation and reduce the number of users granted roles that interact with Academy LMS resources

bash

# Verify the installed Academy LMS plugin version using WP-CLI
wp plugin get academy --field=version

# Update the plugin once a fixed release is published
wp plugin update academy