CVE-2026-104915: Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to permanently delete arbitrary Academy lesson comments and their replies authored by any user, including administrators, across courses they do not instruct. This is exploitable by any user registered as an Academy instructor for at least one course, as they can supply their own courseid to pass the instructor check while targeting comments belonging to entirely different courses.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with custom-level access or higher can exploit it if they are registered as an Academy instructor for at least one course. They do not need to instruct the course containing the comments they target.
What does an attacker need to provide to bypass the authorization check?
The attacker can supply the course_id of a course they instruct to satisfy the instructor check, while supplying a target comment_id belonging to a different course. This allows the authorization check to be decoupled from the comment being deleted.
What is the impact of successful exploitation?
An attacker can permanently delete arbitrary Academy lesson comments and their replies, including comments authored by administrators. The affected comments can belong to courses the attacker does not instruct.
Which installations are affected?
All Academy LMS versions up to and including 4.0.3 are affected, according to the provided information.