The Academy LMS WordPress plugin, in releases before 3.8.3, fails to check whether a user is enrolled in a course or whether a lesson is published before returning lesson data from its REST API. As a result, users who possess a self‑service student (Subscriber) account can retrieve the full content of any lesson, including lessons from paid courses the user has not purchased and lessons that are still in draft, pending, or private states. This enables unauthorized exposure of confidential course material without executing code or altering system state.

The affected product is the Academy LMS WordPress plugin, version numbers less than 3.8.3. No specific vendor is listed, but administrators deploying earlier plugin releases on any WordPress site are at risk. The issue pertains to the lesson REST endpoint that serves lesson content.

The CVSS score of 6.5 indicates a moderate severity vulnerability, yet the EPSS score is less than 1% and it is not listed in CISA KEV, implying a low probability of exploitation in the wild. Because the flaw requires a valid Subscriber account, an attacker must first authenticate, limiting the opportunities for abuse. Nonetheless, the information disclosure that lets students access paid or unpublished content remains a significant concern for course owners and administrators.