CVE-2026-12376: Academy LMS Information Disclosure Flaw

CVE-2026-12376 Overview

The Academy LMS WordPress plugin through version 3.8.2 exposes quiz attempt records to any authenticated subscriber. The plugin fails to restrict access to quiz attempt records based on ownership, resulting in an Insecure Direct Object Reference (IDOR) flaw [CWE-639]. Any user with subscriber-level access who enrolls in a single course can retrieve every user's quiz attempts across the entire site. Exposed data includes IP addresses, real names, registration dates, and quiz results. The issue affects confidentiality of learner data across all courses on the affected installation.

Critical Impact
Authenticated low-privilege attackers can enumerate personal data and quiz results for every user on the affected WordPress site.

Affected Products

Academy LMS WordPress plugin versions up to and including 3.8.2
WordPress installations with the plugin active and open subscriber registration
Sites using the plugin's quiz feature for enrolled learners

Discovery Timeline

2026-07-31 - CVE-2026-12376 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-12376

Vulnerability Analysis

The Academy LMS plugin implements a quiz-attempts endpoint that returns attempt records without validating the requester's ownership of those records. Any authenticated user who is enrolled in at least one course meets the authorization check the plugin performs. That check confirms enrollment status but does not tie returned records to the current user identifier. As a result, subscribers can request arbitrary attempt records belonging to other users and receive full personal data alongside quiz results.

Root Cause

The underlying weakness maps to [CWE-639]: Authorization Bypass Through User-Controlled Key. The plugin trusts an identifier supplied by the client to locate quiz attempt data. It does not enforce a server-side check that the attempt record's user_id matches the authenticated session. Personal Identifiable Information (PII) such as IP addresses, names, and registration timestamps is returned in the same payload as quiz metadata, amplifying the exposure.

Attack Vector

Exploitation requires only a subscriber-level account and enrollment in any single course on the target site. Many Academy LMS deployments allow open registration and free-course enrollment, lowering the practical barrier. An attacker authenticates, enrolls in one course, and then iterates through attempt identifiers by sending crafted requests to the plugin's quiz-attempt endpoint. Each request returns another user's attempt record. No user interaction from the victim is required, and the attack executes entirely over the network.

See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-12376

Indicators of Compromise

Repeated authenticated requests from a single subscriber account to quiz attempt endpoints with sequential or varying attempt identifiers
Web server access logs showing high-volume GET requests to Academy LMS quiz-attempt URLs from low-privilege accounts
Unexpected data-export or scraping patterns originating from newly registered subscriber accounts

Detection Strategies

Review WordPress activity logs for subscriber accounts enumerating quiz attempt identifiers in short time windows
Correlate enrollment events with immediate high-frequency access to quiz-related endpoints
Inspect HTTP request patterns for signs of parameter iteration against Academy LMS endpoints

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and admin-ajax endpoints exposed by Academy LMS
Alert on subscriber accounts that generate abnormally high request volumes to LMS quiz endpoints
Monitor account registrations followed by rapid single-course enrollments and immediate API activity

How to Mitigate CVE-2026-12376

Immediate Actions Required

Update the Academy LMS plugin to a version later than 3.8.2 once a fixed release is published by the vendor
Disable the Academy LMS plugin on production sites until a patch is applied if quizzes contain sensitive learner data
Audit existing subscriber accounts and remove suspicious registrations created before remediation
Restrict new user registration to trusted email domains or require administrator approval

Patch Information

A fixed version beyond 3.8.2 should be applied when released by the plugin vendor. Consult the WPScan Vulnerability Report for the current patch status and any vendor advisory updates.

Workarounds

Disable open subscriber registration in WordPress general settings while a patch is unavailable
Restrict access to Academy LMS quiz endpoints at the web application firewall (WAF) layer for non-privileged roles
Remove or archive historical quiz attempt data that contains PII if the plugin cannot be updated immediately

bash

# Example: block subscriber-role access to the Academy LMS quiz endpoint at the WAF
# (adapt path to your deployment)
location ~* /wp-json/academy/.*/quiz-attempts {
    if ($http_x_wp_role = "subscriber") {
        return 403;
    }
}