CVE-2025-59562: 
WordPress vulnerability analysis and mitigation

CVE-2025-59562 is an Insecure Direct Object Reference (IDOR) / Authorization Bypass Through User-Controlled Key vulnerability in the Kodezen LLC Academy LMS WordPress plugin. It affects all versions up to and including 3.3.4, and was published on September 22, 2025. The flaw allows authenticated attackers with Academy Instructor-level privileges to bypass authorization controls by exploiting incorrectly configured access control security levels. It carries a CVSS v3.1 base score of 5.5 (Medium) (Patchstack).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a form of IDOR where the application uses attacker-controllable keys to reference objects without adequately verifying that the requesting user is authorized to access them. An authenticated user with Academy Instructor privileges can manipulate object references in requests to access or affect resources belonging to other users or outside their permitted scope. The attack vector is network-based, requires no user interaction, and has low attack complexity, though it does require high privileges (Instructor role) to exploit (Patchstack).

Successful exploitation can result in limited confidentiality impact (unauthorized read access to sensitive data) and high availability impact, while integrity is not directly affected per the CVSS scoring. An attacker with Instructor-level access could access resources or data belonging to other users or disrupt availability of certain plugin functionality. The scope is limited to the affected WordPress installation and does not extend beyond the unchanged scope of the vulnerable component (Patchstack).

There is no known public proof-of-concept exploit code or evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.062%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation risk, though it notes that IDOR-class vulnerabilities can be used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Academy LMS plugin version 3.3.4 or earlier, using tools like WPScan or Shodan to enumerate plugin versions.
2. Obtain Instructor Access: Register or compromise an account with Academy Instructor-level privileges on the target site.
3. Identify Object References: Interact with the plugin's endpoints (e.g., course management, student data, or quiz APIs) and observe the object identifiers (IDs) used in requests.
4. Manipulate Object Keys: Modify the user-controlled object reference keys in requests (e.g., changing a course ID or user ID parameter) to reference objects belonging to other users or outside the attacker's permitted scope.
5. Achieve Unauthorized Access: Successfully retrieve sensitive data or trigger availability-impacting actions on resources the attacker should not have access to (Patchstack).

• Logs: WordPress access logs showing repeated requests to Academy LMS plugin endpoints with sequentially or randomly enumerated object ID parameters from a single authenticated session.
• Logs: Unusual access patterns where an Instructor-role account accesses resources (courses, student records, quiz data) not associated with their own account.
• Network: Automated or high-frequency requests to Academy LMS REST API or admin-ajax endpoints with varying ID parameters, potentially indicating enumeration activity.

The vendor has released version 3.3.5 of the Academy LMS plugin, which patches this vulnerability. Site administrators should update to version 3.3.5 or later immediately via the WordPress plugin dashboard. If an immediate update is not possible, consider restricting Instructor-level account registrations or contacting your hosting provider for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

The vulnerability was discovered and reported by security researcher n0_arafat_n0 on August 7, 2025, and published by Patchstack on September 22, 2025. Patchstack classifies it as low priority with unlikely exploitation impact. No significant broader media coverage or notable community discussion has been identified beyond the initial Patchstack advisory (Patchstack).