CVE-2026-104050

Name of the Vulnerable Software and Affected Versions The Academy LMS WordPress plugin versions prior to 4.0.0

Description The plugin fails to verify if a quiz question belongs to a course that the requesting user is authorized to access before returning the answer options. This allows any authenticated user with access to at least one course, such as an enrolled student, to read the quiz answer options for questions in other courses to which they are not enrolled.

Recommendations Update The Academy LMS WordPress plugin to version 4.0.0 or later.