CVE-2026-14184: Unknown Academy Lms

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as completed.

Affected products

• Unknown Academy Lms: before 3.8.1 (fixed in 3.8.1)

Published 2026-07-21. Last modified 2026-07-21.