CVE-2024-35171: 
WordPress vulnerability analysis and mitigation

The Academy LMS WordPress plugin contains a Sensitive Information Exposure vulnerability (CVE-2024-35171) that affects versions up to and including 1.9.25. The vulnerability was discovered by Peng Zhou and publicly disclosed on May 10, 2024. This security issue allows unauthenticated attackers to extract sensitive user or configuration data from WordPress installations running the affected plugin versions (Patchstack, WPScan).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has received a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges or user interaction, and primarily impacts confidentiality (Patchstack).

The vulnerability enables unauthenticated attackers to access sensitive user or configuration data that should normally be restricted. This exposure of sensitive information could potentially be leveraged to exploit other weaknesses in the system (WPScan).

The vulnerability has been classified as having a low severity impact and is considered unlikely to be exploited, though it requires no authentication to exploit (Patchstack).

The vulnerability has been patched in version 1.9.26 of the Academy LMS plugin. Users are advised to update to this version or later to resolve the security issue. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).