CVE-2026-104050: Academy LMS WordPress Information Disclosure

CVE-2026-104050 Overview

CVE-2026-104050 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the Academy LMS WordPress plugin prior to version 4.0.0. The plugin fails to verify that a quiz question belongs to a course the requesting user is authorized to access. Any authenticated user enrolled in at least one course can retrieve quiz answer options from questions in courses they are not enrolled in. The flaw affects confidentiality of quiz content but does not permit modification or disruption of service.

Critical Impact
Authenticated students can harvest quiz answer options from unenrolled courses, undermining assessment integrity across the entire learning platform.

Affected Products

Academy LMS WordPress plugin versions prior to 4.0.0

Discovery Timeline

2026-10-07 - CVE-2026-104050 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-104050

Vulnerability Analysis

The Academy LMS plugin exposes an endpoint that returns quiz question data, including answer options, to authenticated users. The endpoint accepts a question identifier supplied by the client and returns the associated answer records. The handler does not cross-check that the referenced question belongs to a course in which the requesting user is enrolled. This is a classic authorization gap where authentication is validated but object-level access control is missing.

The impact is limited to disclosure of quiz answer options. Attackers cannot modify quiz data or disrupt service through this flaw. However, the leaked data directly undermines the integrity of assessments delivered through the platform, which is the core function of a learning management system.

Root Cause

The root cause is missing authorization enforcement at the object level [CWE-639]. The affected request handler trusts the question identifier supplied by the authenticated caller without validating ownership through the course enrollment relationship. Any valid session with student-level privileges satisfies the authentication check and reaches the data-returning code path.

Attack Vector

Exploitation requires network access and a valid authenticated session with access to at least one course on the target site. An enrolled student iterates through sequential or enumerable quiz question identifiers and records the returned answer options. No user interaction from administrators or other students is required. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-104050

Indicators of Compromise

Repeated authenticated requests to Academy LMS quiz endpoints referencing sequential or non-sequential question identifiers from a single user session.
Access patterns where a student account retrieves quiz data for courses in which the account has no enrollment record in the database.
Spikes in volume of quiz-question API calls that exceed normal student browsing behavior.

Detection Strategies

Review web server access logs for authenticated requests to Academy LMS quiz question endpoints and correlate requested question IDs with the user's enrolled courses.
Enable WordPress plugin audit logging to capture quiz data access events and flag mismatches between requester enrollment and requested course content.
Deploy a Web Application Firewall rule that rate-limits quiz-question endpoint requests per session.

Monitoring Recommendations

Monitor for enumeration patterns against numeric identifiers on /wp-admin/admin-ajax.php or REST routes exposed by Academy LMS.
Alert on single accounts accessing quiz content across an abnormally high number of distinct course IDs within a short time window.
Track student accounts that make quiz-answer requests outside of active quiz sessions.

How to Mitigate CVE-2026-104050

Immediate Actions Required

Upgrade the Academy LMS WordPress plugin to version 4.0.0 or later on all affected sites.
Audit recent access logs for enumeration of quiz question endpoints by student accounts.
Rotate or regenerate quiz content for courses where unauthorized access is suspected before upcoming assessments.

Patch Information

The vendor addressed the vulnerability in Academy LMS version 4.0.0. The fix enforces that the requested quiz question belongs to a course the authenticated user is enrolled in before returning answer options. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

If immediate patching is not possible, restrict access to the plugin's quiz endpoints through server-side access controls or a Web Application Firewall.
Temporarily disable the Academy LMS plugin on sites where graded assessments are in progress until the patched version is deployed.
Limit new student self-registration to reduce the pool of accounts that could abuse the authenticated endpoint.

bash

# Verify installed Academy LMS version via WP-CLI
wp plugin get academy --field=version

# Update the plugin to the patched release
wp plugin update academy --version=4.0.0