Academy LMS Quiz Attempt Data Exposure Vulnerability

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Academy LMS WordPress plugin through version 3.8.2. It allows any authenticated user with subscriber-level access or higher who is enrolled in at least one course to read quiz attempt records belonging to other users across the entire site. This includes sensitive personal data such as IP addresses, names, registration dates, quiz results, and attempt statuses.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to quiz attempts via the REST API endpoint /wp-json/academy/v1/quiz_attempts. Use curl commands like curl -X GET 'http://yoursite.com/wp-json/academy/v1/quiz_attempts' -H 'Authorization: Bearer YOUR_TOKEN' to test if non-owners can retrieve quiz data.

Useful 0 Not Useful 0

Impact Analysis

If you are a user of a WordPress site using the Academy LMS plugin version 3.8.2 or below, an attacker with subscriber access could access your quiz attempt records, including personal data like your IP address, name, registration date, quiz scores, and attempt statuses. This could lead to privacy breaches and misuse of your personal information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data such as IP addresses and names. It may also conflict with HIPAA if health-related quiz data is exposed, as it involves sensitive personal information. Organizations using this plugin must address this flaw to maintain compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Academy LMS plugin to the latest version if available. Restrict subscriber access to only necessary functions and review user enrollments to ensure only authorized users can access quiz data. Monitor logs for suspicious API requests to the quiz_attempts endpoint.

Useful 0 Not Useful 0