CVE-2026-120544: Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route

Q: Who can exploit this issue?

An attacker needs an authenticated WordPress account with at least Contributor-level access. Unauthenticated visitors cannot exploit it based on the available information.

Q: What data can be read through the vulnerable endpoint?

The issue can expose arbitrary files only when their resolved path ends in .html, because the plugin appends that extension before reading the file. Files with other extensions, including wp-config.php, cannot be read through this behavior.

Q: How would exploitation appear to the attacker?

The attacker supplies a traversal path through the id parameter on the /wp/v2/templates REST route. If successful, the target HTML file's full contents are returned in the REST JSON response content field.

Published Nov 3, 2026

Updated

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the attacker-supplied path before reading it, so files with any other extension — including wp-config.php — are out of reach. The file's contents are returned in full in the REST JSON response's content field.

Event History

Nov 3, 2026

CVE Published

via MITRE·04:43 AM

Data Sourced

via MITRE·04:43 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:18 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an authenticated WordPress account with at least Contributor-level access. Unauthenticated visitors cannot exploit it based on the available information.

What data can be read through the vulnerable endpoint?

The issue can expose arbitrary files only when their resolved path ends in .html, because the plugin appends that extension before reading the file. Files with other extensions, including wp-config.php, cannot be read through this behavior.

How would exploitation appear to the attacker?

The attacker supplies a traversal path through the id parameter on the /wp/v2/templates REST route. If successful, the target HTML file's full contents are returned in the REST JSON response content field.

CVE-2026-120544: Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route

Event History

Frequently Asked Questions

Who can exploit this issue?

What data can be read through the vulnerable endpoint?

How would exploitation appear to the attacker?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data can be read through the vulnerable endpoint?

How would exploitation appear to the attacker?