PT-2026-107399 · WordPress · Academy Lms
CVSS v3.1
4.3
متوسطة
| المتجه | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
The Academy LMS WordPress plugin versions prior to 4.0.0
Description
The plugin fails to verify course enrollment or object ownership when returning lesson content via a REST API route. This allows users with self-registerable student accounts to access the full content of arbitrary lessons, including those belonging to private or paid courses for which they are not enrolled.
Recommendations
Update The Academy LMS WordPress plugin to version 4.0.0 or later.
استغلال
إصلاح
IDOR
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Academy Lms