Sorawautsukushiii

**Name of the Vulnerable Software and Affected Versions** The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution versions prior to 3.8.1 **Description** An Insecure Direct Object Reference occurs via the 'save lesson note', 'get lesson note', and 'complete lesson video' AJAX handlers due to missing validation on a user controlled key. This allows authenticated attackers with Subscriber-level access or higher to read, overwrite, or delete private lesson notes of any other user, including administrators, and to falsify lesson-completion progress for arbitrary users. **Recommendations** Update the plugin to version 3.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** Frontend File Manager Plugin versions prior to 23.7 **Description** Authenticated users with Subscriber-level access can delete arbitrary files on the server, including sensitive files like wp-config.php, which may lead to a full site takeover. The issue occurs in the `wpfm file meta update` AJAX handler due to a case-sensitive bypass of the `wpfm dir path` parameter sanitization. By providing the parameter as `WPFM DIR PATH` in uppercase, the unset check is evaded, and the value is later normalized to `wpfm dir path` by the `sanitize key()` function during `update post meta()`. This allows the stored file path to be overwritten with an arbitrary filesystem path, which is then passed to the `unlink()` function within `delete file locally()` without directory containment validation. **Recommendations** Update to the latest version. As a temporary mitigation, restrict access to the `wpfm file meta update` AJAX handler for users with Subscriber-level permissions.