The Academy LMS WordPress plugin in versions prior to 3.8.1 contains an Insecure Direct Object Reference flaw that allows any authenticated subscriber to supply a user identifier in lesson AJAX requests. Because the plugin does not verify that the supplied identifier belongs to the requesting user, an attacker can read, alter, or mark a lesson as completed for another user. This weakness is classified as CWE‑639, indicating improper authorization checks, and can result in unauthorized disclosure of user study progress as well as the ability to falsify completion records, compromising confidentiality and integrity of user data.

The vulnerability affects the Academy LMS WordPress plugin in all releases before 3.8.1. No other vendors or products are listed as impacted.

The CVSS score of 5.4 shows a moderate risk level, mainly involving authenticated data manipulation rather than remote code execution. The EPSS score of < 1 % indicates a low likelihood of exploitation in the wild, and the vulnerability is not present in CISA’s KEV catalog. Exploitation requires a valid subscriber account and the ability to send crafted AJAX requests to lesson endpoints; no elevated privileges or additional access beyond normal subscription permissions are needed. The attack vector is web‑based, leveraging IDOR to bypass access checks. While the chance of real‑world exploitation remains small, the potential impact on user trust and academic integrity warrants prompt remediation.