Unknown Academy Lms vulnerabilities

5 CVEs affecting Unknown Academy Lms, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-104050, published 2026-10-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16563, published 2026-08-03. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service…
CVE-2026-12376, published 2026-07-31. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above (enrolled in any…
CVE-2026-14184, published 2026-07-21. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level…
CVE-2026-104050, published 2026-10-07. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options,…
CVE-2026-104049, published 2026-10-07. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a…