Academy LMS REST API Lesson Content Exposure

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Academy LMS WordPress plugin before version 4.0.0. It allows users with a self-registerable student account (Subscriber+ role) to access the full content of any lesson, including lessons from paid or private courses they are not enrolled in. This happens because the plugin does not verify course enrollment or object ownership when returning lesson content through a REST API route.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if users with Subscriber+ roles can access lesson content they are not enrolled in. Use WordPress REST API requests to test access to lesson endpoints. For example, send a GET request to /wp-json/academy/v1/lessons/{lesson_id} with a user account and verify if unauthorized access occurs.

Useful 0 Not Useful 0

Impact Analysis

If you are a user with a self-registerable student account on a vulnerable Academy LMS site, you could access paid or private course lessons without paying or proper enrollment. For site administrators, this could lead to unauthorized access to sensitive content, potential data breaches, and loss of revenue from paid courses.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by allowing unauthorized access to private or sensitive lesson content. GDPR requires protecting personal data, and HIPAA mandates securing health-related information. Unauthorized access may lead to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Academy LMS to version 4.0.0 or later to patch the vulnerability. If updating is not possible, restrict self-registration for student accounts or disable access to the vulnerable REST API routes until the update is applied.

Useful 0 Not Useful 0