The Academy LMS plugin contains an insecure direct object reference flaw classified as CWE‑639, allowing a user to supply a key that bypasses intended access controls. By manipulating which resource is requested, an attacker can obtain data or perform actions that the policy does not authorize. The vulnerability could expose confidential course materials, personal user data, or administrative settings, thereby compromising confidentiality and potentially integrity.

The flaw is present in all releases of the Academy LMS plugin up to and including version 3.3.4, distributed by Kodezen LLC. WordPress sites that host the plugin in any of these versions are affected.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of current exploitation and it is not listed in the CISA KEV catalog. Attackers typically craft a request that includes a crafted key or identifier to access a protected resource; this usually requires a user to be authenticated, which is inferred from the description of an authorization bypass. Successful exploitation would grant the attacker the privileges associated with the authenticated session without needing higher privileges.