CVE-2026-12376: Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint
The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above (enrolled in any single course) to read every user's quiz attempts across the whole site, including personal data such as IP addresses, names, registration dates and quiz results.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12376?
CVE-2026-12376 has a risk score of 62, indicating a medium level of vulnerability.
What does CVE-2026-12376 affect?
CVE-2026-12376 affects the Academy LMS WordPress plugin versions up to 3.8.2.
How does CVE-2026-12376 impact users?
CVE-2026-12376 allows any authenticated user with subscriber-level access to view other users' quiz attempts, including sensitive personal data.
How do I fix CVE-2026-12376?
To fix CVE-2026-12376, update the Academy LMS WordPress plugin to a version later than 3.8.2.
Who is affected by CVE-2026-12376?
Any user authenticated with a subscriber-level role or higher in the Academy LMS plugin could potentially view sensitive information due to CVE-2026-12376.