The Academy LMS plugin fails to enforce owner‑based access control on its quiz_attempts REST endpoint, enabling any authenticated user with subscriber level or higher to retrieve all quiz attempt records for every site user. The disclosed data includes personal identifiers such as names, IP addresses, registration dates, and quiz results, representing a direct violation of user privacy and confidentiality. No evidence suggests that the flaw impacts integrity or availability, but the breadth of exposed data could facilitate further credential‑based attacks or statistical profiling of site participants.

This vulnerability affects the Academy LMS WordPress plugin for versions 3.8.2 and earlier. Systems running a WordPress site with this plugin installed with default settings are susceptible; the flaw resides in the plugin’s REST API layer rather than the core WordPress installation.

The EPSS score of < 1%, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that no actively exploited variants are currently documented. However, the necessity of only an authenticated subscription role to exploit the flaw indicates a relatively low barrier for attackers who already have legitimate access on the site. With a lack of confidentiality safeguards, an attacker can collect sensitive data at scale. Because the vulnerability affects all users of affected installations, the potential impact is wide, but the overall risk remains moderate to high pending an official fix or workaround.