The Academy LMS plugin for WordPress is vulnerable to an insecure direct object reference in all versions up to and including 3.8.1. The "/topics" REST API endpoint is registered with a permission callback of "__return_true", which allows any user, including unauthenticated visitors, to request private course curriculum data. The vulnerability enables attackers to retrieve detailed course information for private, draft, scheduled, or password‑protected courses simply by enumerating course IDs. This results in the disclosure of proprietary educational content and potentially learner privacy data, constituting an information‑disclosure flaw.

All installations of the Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin provided by kodezen that are version‑3.8.1 or earlier are affected. The vulnerability is present in the plugin code that handles the REST API endpoint; any WordPress site using a vulnerable version and exposing the REST API to the internet can reach the endpoint and bypass authentication checks.

The CVSS base score is 5.3, reflecting moderate severity, while the EPSS score of < 1 % indicates a very low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. An attacker can exploit the issue by sending unauthenticated HTTP GET requests to the vulnerable endpoint and enumerating course identifiers. The attack vector is the internet; no special credentials or system access are required.