The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. This is due to plugin allowing arbitrary user meta updates through the saveduserinfo() function. This makes it possible for authenticated attackers, with minimal permissions such as students, to elevate their user role to that of an administrator.

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the addchild() function calling addrole('academystudent') on any existing account resolved from the attacker-supplied email parameter before Store::link() validates the guardian-ward relationship, and failing to roll back that role write when Store::link() returns a WPError. This makes it possible for authenticated attackers with the academyguardian role or higher to elevate any existing WordPress account — including their own — to the academystudent role, gaining editposts (Contributor-equivalent) capabilities and, when the student file-upload setting is enabled, uploadfiles (Author-equivalent) capabilities not granted to the guardian role. When a guardian supplies their own email address, emailexists() resolves to their own user ID, causing Store::link() to reject the self-link, but because the addrole() call has already executed and is never reversed, the academystudent role grant on their own account persists permanently.

The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to read the quiz answer options of questions belonging to other courses they are not enrolled in.