The Academy LMS plugin for WordPress is vulnerable because it fails to verify the identity of a user before allowing a password change, relying only on a publicly exposed nonce. The flaw is a CWE‑639 authorization bypass vulnerability. This flaw lets an attacker set any user’s password without authentication, enabling administrators and other privileged accounts to be hijacked. The weakness directly compromises both confidentiality and integrity of user accounts and can lead to full system compromise if an attacker gains access to an administrator profile.

The vulnerability affects all releases of the Academy LMS – WordPress LMS Plugin for Complete eLearning Solution up to and including version 3.5.0 distributed by kodezen. Any WordPress site currently running one of these versions is susceptible.

With a CVSS score of 9.8 the issue is considered critical. The EPSS score of less than 1% indicates that exploitation is unlikely but not impossible, and the weakness is not currently listed in the CISA KEV catalog. The likely attack path involves sending an unauthenticated HTTP request to the password‑reset endpoint, where the plugin accepts the nonce and changes the target user’s password. Once access is gained, further privilege escalation or data exfiltration may follow.