CVE-2026-14184 – Academy LMS < 3.8.1 – Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR

CVE ID :CVE-2026-14184

Published : July 21, 2026, 7:16 a.m. | 28 minutes ago

Description :The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users’ lesson notes and mark other users’ lesson content as completed.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…