CVE-2026-14184: Academy LMS Auth Bypass Vulnerability

CVE-2026-14184 Overview

CVE-2026-14184 is an Insecure Direct Object Reference (IDOR) vulnerability in the Academy LMS WordPress plugin versions prior to 3.8.1. The plugin fails to verify ownership of user-supplied user identifiers in several lesson-related AJAX handlers. Authenticated attackers holding subscriber-level accounts can read and modify other users' lesson notes. They can also mark other users' lesson content as completed, corrupting course progress tracking. The flaw is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated subscriber can access and tamper with lesson notes and completion status belonging to other Academy LMS users, breaking data confidentiality and integrity across the learning platform.

Affected Products

Academy LMS WordPress plugin versions prior to 3.8.1
WordPress installations exposing subscriber-level registration with Academy LMS enabled
Any Academy LMS deployment where multiple learners share the platform

Discovery Timeline

2026-07-21 - CVE-2026-14184 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-14184

Vulnerability Analysis

The Academy LMS plugin exposes multiple AJAX endpoints that accept a user_id parameter supplied directly by the client. These handlers process operations on lesson notes and lesson completion state. The plugin trusts the submitted identifier without confirming that the currently authenticated session owns that record. As a result, a subscriber can substitute another user's identifier and act on their data. The vulnerability allows both read access to private lesson notes and write access to modify notes or completion flags belonging to other students.

Root Cause

The root cause is missing authorization enforcement on user-scoped resources, mapped to CWE-639. The affected AJAX handlers perform authentication checks and confirm that the caller is a logged-in WordPress user. They do not compare the authenticated session's user identifier against the user_id parameter passed with the request. This omission separates authentication from authorization, allowing any valid session to reference records owned by other accounts.

Attack Vector

Exploitation requires an authenticated account, which in most Academy LMS deployments is trivial to obtain through open subscriber registration. The attacker submits crafted POST requests to the vulnerable lesson AJAX endpoints, replacing the user_id value with the target victim's identifier. The server returns or updates the targeted user's lesson notes and completion status. No user interaction from the victim is required, and the attack executes over the network against the WordPress admin-ajax handler. Full technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-14184

Indicators of Compromise

Unexpected modifications to lesson notes attributed to users who did not author them
Lesson completion records marked as complete without corresponding lesson access logs
Repeated POST requests to Academy LMS AJAX endpoints with varying user_id values from a single session

Detection Strategies

Inspect WordPress access logs for POST requests to admin-ajax.php targeting Academy LMS lesson actions with mismatched authenticated user identifiers
Correlate the authenticated cookie or session with the user_id parameter submitted in each AJAX call and alert on discrepancies
Review Academy LMS database tables for lesson note edits whose author identifier does not match recent authenticated activity

Monitoring Recommendations

Enable verbose logging on admin-ajax.php and retain request bodies for lesson-related actions
Track subscriber account behavior for sequential enumeration of numeric user identifiers
Alert on anomalous volumes of lesson-note or lesson-completion updates originating from low-privilege accounts

How to Mitigate CVE-2026-14184

Immediate Actions Required

Update the Academy LMS WordPress plugin to version 3.8.1 or later on all affected sites
Audit lesson notes and completion records for unauthorized changes since the plugin was installed
Review subscriber accounts and disable any that appear to have engaged in enumeration or tampering

Patch Information

The vendor addressed the vulnerability in Academy LMS version 3.8.1 by adding ownership verification to the affected lesson AJAX handlers. Site administrators should apply the update through the WordPress plugin manager. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable open subscriber registration on Academy LMS sites until the plugin is updated
Restrict access to admin-ajax.php for Academy LMS lesson actions using a web application firewall rule that validates the user_id parameter against the session
Temporarily deactivate the Academy LMS plugin on sites where an immediate update is not feasible

bash

# Configuration example: WordPress WP-CLI update command
wp plugin update academy --version=3.8.1