CVE-2026-5348: Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.8.1. This is due to the '/topics' REST API endpoint being registered with a permission callback set to 'returntrue', allowing unauthenticated access to course curriculum data without verifying the course's post status or user enrollment. This makes it possible for unauthenticated attackers to access detailed curriculum information for private, draft, scheduled, or password-protected courses by enumerating course IDs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution (Academy LMS)to a version that resolves this vulnerability.Fixed in 3.8.1 - Configuration
Modify the '/topics' REST API endpoint so its permission callback does not return '__return_true'; require authentication and enforce checks for course post status and user enrollment to prevent unauthenticated disclosure of private/draft/scheduled/password-protected course curriculum data.
Academy LMS WordPress plugin /topics REST API endpoint permission callback = __return_true
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5348?
CVE-2026-5348 has a medium severity rating of 5.3.
What does CVE-2026-5348 exploit in Academy LMS?
CVE-2026-5348 exploits an Unauthenticated Insecure Direct Object Reference, allowing disclosure of private topics.
How do I fix CVE-2026-5348?
To fix CVE-2026-5348, upgrade Academy LMS to version 3.8.2 or later.
Who is affected by CVE-2026-5348?
Users of Academy LMS versions up to and including 3.8.1 are affected by CVE-2026-5348.
What is the impact of CVE-2026-5348?
The impact of CVE-2026-5348 is the potential unauthorized disclosure of private topics within the LMS.