The Academy LMS plugin contains a flaw in the add_child() REST endpoint that grants the academy_student role to any WordPress user identified by an email address supplied to the endpoint. The role is added before the plugin verifies the guardian-ward relationship and before the Store::link() call can roll back the assignment when an error occurs. Because the add_role() call is never undone, an authenticated attacker who holds the academy_guardian role—or a higher role—can elevate any existing account, including their own, to academy_student, acquiring edit_posts capabilities. If the plugin’s student file‑upload setting is enabled, the attacker also receives upload_files rights, effectively granting author‑level file upload privileges. The flaw can persist after a self‑link rejection, allowing a guardian to permanently raise their own role. The vulnerability is a CWE‑269 Access Control issue and can be exploited through a standard authenticated request to the add_child endpoint with an arbitrary email address. It does not enable arbitrary code execution or broader system compromise outside WordPress. Risk and exploitability analysis shows a CVSS score of 5.4, indicating moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited observed exploitation. However, the attack requires only legitimate authentication and routine REST access, conditions commonly available to site administrators. Once exploited, the attacker can gain contributor‑level editing rights and, if file uploading is enabled, author‑level upload rights, facilitating potential content manipulation or malicious file placement. Affected systems are all WordPress installations running Academy LMS version 4.0.3 or earlier, authored by kodezen. Any site that has installed the plugin and has users with the academy_guardian role or higher is potentially vulnerable, especially if the student file‑upload configuration is enabled. The risk is moderate but significant due to the privilege escalation within WordPress; prompt patching mitigates the issue entirely. Risk and exploitability: The flaw can be exploited by any authenticated guardian through the documented restore_endpoint, which exposes a single REST route. No additional external access or code execution is required. The CVSS base score of 5.4 reflects the impact on confidentiality, integrity, and availability confined to application-level permissions. The lack of EPSS and KEV status indicates no widespread exploitation yet, but the ease of exploitation warrants immediate attention. Affected systems: WordPress sites using Academy LMS 4.0.3 or earlier, with users assigned the academy_guardian role or higher. The vulnerability affects all accounts that can be referenced via the email parameter, including the attacker’s own account. Risk and exploitability: Moderately high due to easy authenticated access and lack of rollback logic, but the impact is limited to WordPress privileges. The CVSS score of 5.4 and the absence of EPSS data suggest moderate threat. Since the flaw is not on the CISA KEV list, it may not be widely exploited yet, but any authenticated guardian can exploit the REST endpoint to elevate privileges. The exploitation path is straightforward: send a POST request to add_child with an email argument. No additional conditions are needed, and the issue persists after a self-link denial because of the missing rollback.

All WordPress installations that have the Academy LMS plugin by kodezen version 4.0.3 or earlier are affected. Any site that has installed the plugin and has users with the academy_guardian role or higher is potentially vulnerable, particularly if the student file‑upload configuration is enabled. The vulnerability applies to any WordPress account that can be referenced by email within the add_child endpoint.

CVSS score 5.4 indicates moderate severity. EPSS data is unavailable; KEV status is not listed, implying no known exploitation in the wild. The flaw is exploitable by any authenticated guardian through the add_child REST endpoint, which requires only standard authenticated access. The attacker can elevate accounts to academy_student, granting edit_posts and possibly upload_files if file‑upload is enabled. The vulnerability is limited to WordPress application privileges, but it permits significant content manipulation and potential introduction of malicious files. The ease of exploitation and lack of rollback amplifies the risk, warranting prompt remediation.