CVE-2026-120544
MediumCVSS 4.3Summary
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress in versions up to and including 4.0.1 is vulnerable to directory traversal via the 'id' parameter. Authenticated attackers with contributor-level access can read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the supplied path, so files with other extensions, including wp-config.php, are out of reach, and the file contents are returned in the REST JSON response's content field.
Risk Assessment
An attacker could read .html file contents, potentially disclosing site information. The risk is limited to .html files but still breaches confidentiality.
Recommendation
Update the plugin to a version later than 4.0.1 as soon as it is available and limit contributor accounts. Until then, consider restricting access to the plugin's REST endpoints.
Other vulnerabilities in Academy LMS WordPress plugin
See all- CVE-2026-104050Medium
The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options. This allows any authenticated user with access to a single course, such as an enrolled student, to read the quiz answer options of questions belonging to other courses they are not enrolled in.
- CVE-2026-104049Medium
The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes. This allows users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of paid or private courses they are not enrolled in.
- CVE-2026-16563Medium
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson via REST API. Users with a Subscriber-level account can disclose the content of arbitrary lessons, including paid course lessons they are not enrolled in and unpublished lessons.
- CVE-2026-14184Medium
The Academy LMS WordPress plugin before version 3.8.1 does not verify ownership of user identifiers in several AJAX handlers. Authenticated users with subscriber-level access can read and modify other users' lesson notes and mark their content as completed.
Original NVD description (English source)
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the attacker-supplied path before reading it, so files with any other extension — including wp-config.php — are out of reach. The file's contents are returned in full in the REST JSON response's content field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS