CVE-2026-16563: Academy LMS Information Disclosure Flaw

CVE-2026-16563 Overview

CVE-2026-16563 is a broken access control vulnerability in the Academy LMS WordPress plugin versions before 3.8.3. The plugin exposes a REST API endpoint that returns individual lesson content without validating course enrollment or lesson publication status. An authenticated user holding a Subscriber-level (self-service student) account can retrieve lesson content from paid courses they have not purchased. The same endpoint also returns unpublished lessons in draft, pending, or private states. The flaw is tracked under CWE-284: Improper Access Control.

Critical Impact
Any registered user can read paid and unpublished lesson content through the plugin REST API, undermining course monetization and content confidentiality.

Affected Products

Academy LMS WordPress plugin versions prior to 3.8.3
WordPress sites permitting self-service Subscriber registration with Academy LMS installed
Paid course deployments relying on Academy LMS enrollment gating

Discovery Timeline

2026-08-03 - CVE-2026-16563 published to the National Vulnerability Database
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-16563

Vulnerability Analysis

The Academy LMS plugin exposes a REST API route that returns a single lesson by identifier. The handler does not verify that the requesting user is enrolled in the parent course. It also fails to check the lesson's publication state before returning content. As a result, a low-privilege authenticated user can iterate lesson identifiers and retrieve the body of any lesson stored by the plugin.

The exposure covers three distinct content categories: lessons belonging to paid courses without a valid enrollment, lessons marked as draft or pending, and lessons set to private visibility. Confidentiality impact is high, while integrity and availability are unaffected because the endpoint is read-only.

Root Cause

The root cause is missing authorization logic in the REST controller responsible for serving individual lessons. The endpoint relies on WordPress authentication to accept the request but omits the enrollment lookup and post-status check that gate the standard front-end lesson view. This pattern maps to CWE-284, where access decisions are absent rather than incorrectly evaluated.

Attack Vector

Exploitation requires only a valid Subscriber account, which the plugin's self-service registration flow provides by default. The attacker authenticates to WordPress, obtains a REST nonce or application password, and issues authenticated GET requests to the lesson endpoint while incrementing the lesson identifier. Each response containing lesson content confirms unauthorized disclosure. See the WPScan Vulnerability Report for reference details.

Detection Methods for CVE-2026-16563

Indicators of Compromise

Sequential authenticated GET requests to Academy LMS lesson REST endpoints from a single Subscriber account within a short time window
REST API responses returning 200 OK with lesson content for user IDs that lack matching enrollment records in the Academy LMS database tables
Access log entries where Subscriber-level sessions request lesson identifiers tied to draft, pending, or private post statuses

Detection Strategies

Correlate WordPress REST API access logs with Academy LMS enrollment tables to identify lesson retrievals without a matching enrollment row
Alert on high-volume lesson endpoint enumeration originating from accounts with the subscriber role
Review WordPress audit logs for newly registered Subscriber accounts followed immediately by REST API traffic to /wp-json/ lesson routes

Monitoring Recommendations

Enable verbose REST API logging on WordPress and forward events to a centralized log platform for retention and correlation
Baseline normal lesson access patterns per user role and flag deviations, particularly Subscriber accounts accessing paid course content
Monitor for spikes in new user registrations on sites running Academy LMS below version 3.8.3

How to Mitigate CVE-2026-16563

Immediate Actions Required

Upgrade the Academy LMS plugin to version 3.8.3 or later on all affected WordPress installations
Audit existing Subscriber accounts and revoke any created during the exposure window that show anomalous REST API activity
Rotate application passwords and REST API credentials for accounts that may have been leveraged for enumeration

Patch Information

The vendor addressed the issue in Academy LMS version 3.8.3 by adding enrollment and publication status checks to the single-lesson REST endpoint. Administrators should apply the update through the WordPress plugin manager or via WP-CLI. Confirm the installed version matches 3.8.3 or higher after the update completes.

Workarounds

Disable self-service user registration in WordPress settings until the plugin is patched to reduce the pool of accounts capable of exploitation
Restrict access to /wp-json/academy/ REST routes at the web server or WAF layer for unauthenticated and Subscriber-role sessions
Temporarily deactivate the Academy LMS plugin on sites hosting sensitive draft or paid lesson content if patching cannot be scheduled immediately

bash

# Update Academy LMS via WP-CLI
wp plugin update academy --version=3.8.3
wp plugin list --name=academy --fields=name,status,version

# Disable open user registration as a temporary control
wp option update users_can_register 0