CVE-2026-25372: WordPress Academy LMS plugin <= 3.5.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Academy LMS: from n/a through <= 3.5.3.
Affected Software
Event History
Frequently Asked Questions
Which Academy LMS installations are in scope?
The issue affects Kodezen LLC Academy LMS versions through 3.5.3. The available data does not identify an unaffected fixed version.
What access does an attacker need to exploit this issue?
Exploitation is network-reachable and requires low-privileged authenticated access. It does not require user interaction and is rated low complexity.
What is the expected security impact?
The CVSS vector indicates a high integrity impact, with no stated confidentiality or availability impact. This means successful exploitation may allow unauthorized modification rather than data disclosure or service disruption.
How likely is exploitation according to the available prioritization data?
The listed EPSS probability is 0.00029, at percentile 8. This indicates comparatively low predicted exploitation likelihood in the available EPSS data.