CyberRota Analysis
AI-GeneratedThe Academy LMS WordPress plugin prior to version 3.8.3 is vulnerable due to inadequate verification of course enrollment and lesson publication status in its REST API. This flaw allows users with Subscriber-level accounts to access and disclose content from arbitrary lessons, including those from paid courses and unpublished materials. WordPress site administrators using this plugin should prioritize patching to prevent unauthorized content exposure.
Original NVD Description
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student (Subscriber-level) account to disclose the content of arbitrary lessons, including lessons of paid courses they are not enrolled in and unpublished (draft, pending, private) lessons.