The Academy LMS WordPress plugin contains a missing validation on the ‘user_id’ parameter in the ‘save_lesson_note’, ‘get_lesson_note’, and ‘complete_lesson_video’ AJAX handlers. Because the plugin accepts the key directly without checking ownership, an authenticated user with at least Subscriber level can read, overwrite, or delete the private lesson notes belonging to any account. The same flaw also allows the attacker to manipulate lesson‑completion progress for arbitrary users, effectively corrupting learning records. This is a classic Insecure Direct Object Reference under CWE‑639.

All installations of the Academy LMS WordPress plugin up to and including version 3.8.0 are affected. The flaw exists in the core plugin code referenced in the 3.7.4 release and applies to any site running a 3.8.0 or earlier build of the plugin.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low but non-zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the WordPress site with a Subscriber or higher role; no public unauthenticated access is required. Once authenticated, they can exploit the flaw to gain unauthorized access to other users’ private lesson data and falsify completion metrics.