Academy LMS

Vulnerabilities

• CVE-2025-15521

  Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover

  Critical 9.8

• CVE-2024-38701

  WordPress Academy LMS plugin <= 2.0.4 - Broken Access Control vulnerability

  High 8.8

• CVE-2024-32714

  WordPress Academy LMS plugin <= 1.9.16 - Broken Access Control vulnerability

  High 8.8

• CVE-2024-33912

  WordPress Academy LMS plugin <= 1.9.16 - Broken Access Control on Paid Courses vulnerability

  High 8.8

• CVE-2024-1505

  Academy LMS – eLearning and online course solution for WordPress <= 1.9.19 - Authenticated (Subscriber+) Privilege Escalation

  High 8.8

• CVE-2025-12099

  Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'

  High 7.2

• CVE-2026-25372

  WordPress Academy LMS plugin <= 3.5.3 - Broken Access Control vulnerability

  Medium 6.5

• CVE-2025-68527

  WordPress Academy LMS plugin <= 3.4.0 - Cross Site Scripting (XSS) vulnerability

  Medium 6.5

• CVE-2025-59562

  WordPress Academy LMS Plugin <= 3.3.4 - Insecure Direct Object References (IDOR) Vulnerability

  Medium 5.5

• CVE-2026-5348

  Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure

  Medium 5.3

• CVE-2024-35171

  WordPress Academy LMS plugin <= 1.9.25 - Sensitive Data Exposure vulnerability

  Medium 5.3

• CVE-2026-9341

  Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter

  Medium 4.3

• CVE-2024-37234

  WordPress Academy LMS plugin <= 2.0.4 - Open Redirection vulnerability

  Low 3.5