CVE-2026-5348

Name of the Vulnerable Software and Affected Versions Academy LMS – WordPress LMS Plugin for Complete eLearning Solution versions prior to 3.8.2

Description An Insecure Direct Object Reference exists due to the '/topics' REST API endpoint being registered with a permission callback set to return true. This configuration allows unauthenticated access to course curriculum data without verifying user enrollment or the post status of the course. Consequently, unauthenticated attackers can access detailed curriculum information for courses that are private, draft, scheduled, or password-protected by enumerating course IDs.

Recommendations Update the plugin to a version newer than 3.8.1. As a temporary mitigation, restrict access to the '/topics' REST API endpoint.