CVE-2026-104049: Academy LMS Auth Bypass Vulnerability

CVE-2026-104049 Overview

CVE-2026-104049 affects the Academy LMS WordPress plugin in versions prior to 4.0.0. The plugin exposes a REST API route that returns lesson content without verifying course enrollment or object ownership. Any authenticated user with a self-registered student account can read the full content of arbitrary lessons, including lessons from paid or private courses they have not enrolled in. The flaw maps to CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Low-privileged student accounts can harvest premium lesson content from the Academy LMS plugin, undermining paywalls and content-access controls on affected WordPress sites.

Affected Products

Academy LMS WordPress plugin versions prior to 4.0.0
WordPress sites that permit self-registration of student accounts
Any Academy LMS deployment selling paid or restricting private course content

Discovery Timeline

2026-10-07 - CVE-2026-104049 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-104049

Vulnerability Analysis

Academy LMS registers REST API routes to deliver lesson content to enrolled students. One of these routes resolves a lesson identifier supplied in the request and returns the lesson body in the response. The route handler performs an authentication check sufficient to confirm the caller is a logged-in user, but it does not evaluate whether that user is enrolled in the parent course or otherwise authorized to view the lesson.

As a result, the authorization logic relies solely on possession of a lesson ID, which is a user-controlled key. This is the pattern described by CWE-639. The impact is limited to confidentiality of lesson text; integrity and availability of the site are not affected.

Root Cause

The REST route handler trusts the lesson ID parameter and skips the enrollment check that gates lesson access in the standard front-end rendering path. The missing authorization check means course-level access control is enforced in the UI but not at the API layer.

Attack Vector

An attacker registers a free student account on a vulnerable site, obtains a valid session or authentication cookie, and then iterates lesson IDs against the vulnerable REST route. The handler returns the full lesson payload for any ID that exists, regardless of enrollment status. Discovery of valid lesson IDs is straightforward because they are typically sequential integers.

No verified exploit code is published. See the WPScan Vulnerability Report #277f48d0 for additional technical context.

Detection Methods for CVE-2026-104049

Indicators of Compromise

Sequential or high-volume authenticated requests to Academy LMS REST routes under /wp-json/academy/ targeting lesson endpoints
Student accounts retrieving lesson payloads for courses in which no enrollment record exists in the Academy LMS database tables
Spikes in self-registered student accounts followed by sustained REST API activity from the same source IP

Detection Strategies

Correlate WordPress access logs with Academy LMS enrollment records to flag lesson reads that lack a matching enrollment row
Alert on single sessions enumerating lesson IDs across multiple distinct courses within a short time window
Review web application firewall telemetry for unauthenticated or newly registered users hitting lesson REST endpoints at a rate inconsistent with normal study behavior

Monitoring Recommendations

Enable verbose logging on /wp-json/academy/* routes and ship logs to a centralized analytics platform
Track account creation volume and the time delta between registration and first REST API call
Monitor for scripted user agents or missing Referer headers on lesson API requests

How to Mitigate CVE-2026-104049

Immediate Actions Required

Upgrade the Academy LMS plugin to version 4.0.0 or later on every affected WordPress site
Audit recent student registrations and revoke accounts that exhibit the enumeration patterns described above
Rotate any lesson content that is treated as commercially sensitive and may have been exfiltrated

Patch Information

The vendor addressed the issue in Academy LMS version 4.0.0 by adding enrollment and ownership checks to the affected REST API route. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable self-registration of student accounts until the plugin is upgraded
Restrict access to /wp-json/academy/ lesson routes at the WAF or reverse proxy to known enrolled user sessions
Temporarily deactivate the Academy LMS plugin on sites where upgrading is not immediately possible

bash

# Example WAF rule: block authenticated lesson API access from accounts
# created within the last 24 hours until upgrade to >= 4.0.0 is confirmed
SecRule REQUEST_URI "@rx ^/wp-json/academy/.*/lesson" \
    "id:1040490,phase:2,deny,status:403,log,\
    msg:'Academy LMS lesson API access blocked pending CVE-2026-104049 patch'"