CVE-2026-9341: Academy LMS Auth Bypass Vulnerability

CVE-2026-9341 Overview

CVE-2026-9341 is an Insecure Direct Object Reference (IDOR) vulnerability in the Academy LMS WordPress plugin, affecting all versions up to and including 3.8.0. The flaw resides in the save_lesson_note, get_lesson_note, and complete_lesson_video AJAX handlers, which fail to validate a user-controlled key. Authenticated attackers with Subscriber-level access or higher can read, overwrite, or delete private lesson notes belonging to other users, including administrators. Attackers can also falsify lesson-completion progress for arbitrary users. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated Subscriber can access, modify, or destroy private lesson notes of any other user on the affected WordPress site and manipulate their lesson progress records.

Affected Products

Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
All versions up to and including 3.8.0
WordPress sites running the vulnerable plugin with open user registration enabled

Discovery Timeline

2026-07-14 - CVE-2026-9341 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-9341

Vulnerability Analysis

The vulnerability originates in three AJAX endpoints exposed by the Academy LMS plugin. Each handler accepts a user-supplied identifier used to reference lesson-note records or lesson-progress entries. The plugin trusts this identifier without verifying that the requesting user owns the referenced object. As a result, any authenticated user can substitute another user's identifier and operate on records that do not belong to them.

The abstract AJAX handler class centralizes request dispatch but does not enforce object-level ownership checks. Because Academy LMS supports Subscriber-level registration for course participants, exploitation only requires an account created through the standard WordPress registration flow. This lowers the barrier to abuse on any site that permits self-service enrollment.

Root Cause

The root cause is missing authorization enforcement on a user-controlled key, matching the [CWE-639] pattern. The save_lesson_note, get_lesson_note, and complete_lesson_video handlers rely on capability checks (authenticated user) but skip per-object ownership validation. See the vulnerable source references at lesson.php L253, L258, and L300, along with the abstract AJAX handler.

Attack Vector

An attacker registers or logs in as a Subscriber, then issues WordPress AJAX POST requests to admin-ajax.php targeting the affected actions. By supplying another user's note identifier or user identifier, the attacker retrieves, overwrites, or deletes lesson notes belonging to that user, or marks lessons complete on the victim's behalf. The attack is remote, low complexity, and requires no user interaction from the victim.

For technical exploitation details, refer to the Wordfence vulnerability analysis and the vendor's change set #3573111.

Detection Methods for CVE-2026-9341

Indicators of Compromise

Unexpected modifications, deletions, or additions to lesson-note records tied to accounts that did not author them.
Lesson-completion entries recorded for users during periods when they were not logged in or active.
High volumes of POST requests to admin-ajax.php with action=save_lesson_note, action=get_lesson_note, or action=complete_lesson_video originating from Subscriber accounts.

Detection Strategies

Audit web server access logs for repeated requests to admin-ajax.php referencing the three affected actions from a single low-privilege session.
Compare user_id fields in submitted AJAX payloads against the WordPress session cookie owner to identify identifier substitution attempts.
Review the plugin's lesson-note and progress database tables for records whose author ID does not match the associated user context.

Monitoring Recommendations

Enable WordPress audit logging to capture AJAX action invocations, request parameters, and the authenticated user for each request.
Alert on newly registered Subscriber accounts that immediately issue requests to LMS AJAX endpoints.
Monitor administrator accounts for unexpected changes to lesson notes or progress data attributed to their user ID.

How to Mitigate CVE-2026-9341

Immediate Actions Required

Update the Academy LMS plugin to a version later than 3.8.0 that includes the fix from change set #3573111.
If patching is not immediately possible, disable open user registration or restrict the Subscriber role on affected WordPress sites.
Review lesson-note and lesson-progress database tables for tampering and restore from backup where integrity cannot be verified.

Patch Information

The vendor addressed the vulnerability in the release following version 3.8.0. The fix, tracked in WordPress plugin repository change set #3573111, adds ownership validation to the affected AJAX handlers so that user-supplied identifiers are cross-checked against the authenticated user before read, write, or delete operations proceed.

Workarounds

Temporarily deactivate the Academy LMS plugin on sites where updates cannot be applied promptly.
Restrict access to admin-ajax.php for the save_lesson_note, get_lesson_note, and complete_lesson_video actions through a web application firewall rule.
Disable self-service registration by unchecking "Anyone can register" under WordPress General Settings to reduce the pool of potential attackers.

bash

# Example WAF rule to block the affected AJAX actions until patched
# ModSecurity syntax
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,deny,status:403,id:1029341,msg:'Block Academy LMS IDOR CVE-2026-9341'"
    SecRule ARGS:action "@rx ^(save_lesson_note|get_lesson_note|complete_lesson_video)$"