CVE-2026-25372: Academy LMS Auth Bypass Vulnerability

CVE-2026-25372 Overview

CVE-2026-25372 is a Missing Authorization vulnerability (CWE-862) affecting Kodezen LLC Academy LMS, a WordPress plugin used for creating and managing online learning management systems. This vulnerability allows authenticated attackers to exploit incorrectly configured access control security levels, potentially bypassing authorization checks to perform unauthorized actions within the platform.

Critical Impact
Authenticated attackers with low privileges can exploit broken access control mechanisms to modify data or perform actions beyond their authorized scope, potentially compromising the integrity of the learning management system.

Affected Products

Academy LMS plugin versions through 3.5.3
WordPress installations using vulnerable Academy LMS versions
Kodezen LLC Academy LMS (all versions from n/a through <= 3.5.3)

Discovery Timeline

2026-02-19 - CVE CVE-2026-25372 published to NVD
2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-25372

Vulnerability Analysis

This vulnerability represents a Broken Access Control flaw where the Academy LMS plugin fails to properly verify user authorization before allowing certain operations. The missing authorization checks enable authenticated users to perform actions that should be restricted to higher-privileged accounts or administrators. While exploitation requires network access and authenticated user privileges, the attack complexity is low and no user interaction is needed to execute the attack.

The vulnerability allows attackers to bypass intended access restrictions, resulting in high integrity impact as unauthorized modifications to system data become possible. The confidentiality and availability of the system remain unaffected by this specific vulnerability.

Root Cause

The root cause of CVE-2026-25372 lies in missing authorization verification within the Academy LMS plugin. The application fails to implement proper access control checks on certain functionality, allowing authenticated users to access and execute operations without confirming whether they possess the appropriate permissions. This is a common security flaw in WordPress plugins where capability checks or nonce verification may be absent from sensitive functions.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an attacker to have low-level authenticated access to the WordPress installation. Once authenticated, the attacker can send crafted requests to exploit the missing authorization checks.

The exploitation flow typically involves:

Attacker authenticates to the WordPress site with a low-privileged user account (such as subscriber or student role)
Attacker identifies endpoints or functionality within Academy LMS that lack proper authorization checks
Attacker crafts requests to access restricted features or modify data without proper authorization
The plugin processes the request without verifying the user has appropriate permissions

For detailed technical information about this vulnerability, refer to the Patchstack security advisory.

Detection Methods for CVE-2026-25372

Indicators of Compromise

Unusual administrative actions performed by low-privileged user accounts
Unexpected modifications to course content, user enrollments, or LMS settings
Access logs showing non-admin users accessing admin-only Academy LMS endpoints
Anomalous API requests to Academy LMS plugin endpoints from subscriber or student accounts

Detection Strategies

Implement WordPress activity logging to monitor all Academy LMS plugin operations and user actions
Deploy web application firewall (WAF) rules to detect and block suspicious requests to Academy LMS endpoints
Review user role assignments and audit permissions to identify potential privilege abuse
Monitor for unauthorized changes to course materials, student data, or plugin settings

Monitoring Recommendations

Enable comprehensive WordPress audit logging with plugins like WP Activity Log
Configure alerts for sensitive Academy LMS operations performed by non-admin users
Regularly review access logs for signs of authorization bypass attempts
Implement real-time monitoring for changes to critical LMS data and configurations

How to Mitigate CVE-2026-25372

Immediate Actions Required

Update Academy LMS plugin to the latest patched version beyond 3.5.3
Review recent user activity logs for signs of unauthorized access or modifications
Audit user roles and permissions within the Academy LMS plugin
Temporarily restrict access to the LMS functionality if immediate patching is not possible

Patch Information

Organizations using Academy LMS should update to a version that addresses this vulnerability. The vendor, Kodezen LLC, should be consulted for the specific patched version. Check the Patchstack advisory for the latest patch information and recommended upgrade path.

To update the plugin via WordPress admin:

Navigate to Plugins > Installed Plugins
Locate Academy LMS and check for available updates
Click "Update Now" to install the patched version
Verify the update was successful and test LMS functionality

Workarounds

Restrict user registration and carefully vet new account requests until patching is complete
Implement additional access controls at the server level (e.g., IP whitelisting for admin functions)
Use a Web Application Firewall to add an extra layer of protection against unauthorized requests
Consider temporarily disabling non-essential Academy LMS features for low-privileged users

bash

# WordPress CLI command to update Academy LMS plugin
wp plugin update academy --allow-root

# Verify the installed version after update
wp plugin get academy --field=version

# Check for any remaining vulnerable plugins
wp plugin list --update=available --format=table