Authentication Bypass in Academy LMS WordPress Plugin

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Academy LMS WordPress plugin before version 3.8.1. It allows authenticated users with subscriber-level access to read and modify other users' lesson notes and mark their lesson content as completed without proper authorization checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Academy LMS plugin version is below 3.8.1. Log in as a subscriber and attempt to access or modify another user's lesson notes or completion status via the admin-ajax.php endpoint. Monitor for unauthorized data changes or access attempts.

Useful 0 Not Useful 0

Impact Analysis

If you are a subscriber on a vulnerable site, an attacker with a subscriber account could access or alter your private lesson notes and mark your lessons as completed without your consent. This could lead to data exposure or incorrect tracking of your progress.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate GDPR by exposing or allowing unauthorized modification of user data, such as lesson notes. It may also conflict with HIPAA if user data processed by the plugin includes protected health information, as it enables unauthorized access or changes.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Academy LMS plugin to version 3.8.1 or later. If updating is not possible, disable the plugin temporarily until the update is applied. Review user roles and permissions to ensure subscribers do not have unnecessary access to sensitive functions.

Useful 0 Not Useful 0