CVE-2026-16563: 
WordPress vulnerability analysis and mitigation

CVE-2026-16563 is a Broken Access Control vulnerability in the Academy LMS WordPress plugin (by Kodezen LLC) that allows authenticated users with Subscriber-level accounts to disclose the content of arbitrary lessons via the plugin's REST API. The vulnerability affects all versions of the plugin before 3.8.3 and was publicly disclosed on July 24, 2026, with a patch released in version 3.8.3. It carries a CVSS score of 4.3 (Medium) and is classified under CWE-284 (Improper Access Control) (WPScan, GitHub Advisory).

The root cause is insufficient authorization logic in the Academy LMS plugin's REST API endpoint for retrieving individual lessons (CWE-284: Improper Access Control, OWASP A5: Broken Access Control). When a request is made to the lessons REST endpoint, the plugin fails to verify whether the requesting user is enrolled in the associated course or whether the lesson has been published, returning lesson content regardless of these conditions. This means any self-registered Subscriber-level user can craft a direct API request to retrieve lesson content from paid courses they have not purchased, as well as lessons in draft, pending, or private publication states. The vulnerability was discovered and reported by researcher Pedro Pinho (WPScan).

Successful exploitation results in unauthorized disclosure of lesson content, including paid course material and unpublished (draft, pending, private) lessons, to any authenticated Subscriber-level user. This directly undermines the business model of sites using Academy LMS for paid course delivery, as premium content can be accessed without purchase or enrollment. While the vulnerability does not enable code execution or privilege escalation, the confidentiality impact to course operators and content creators is significant (WPScan, GitHub Advisory).

1. Account Registration: Register a free Subscriber-level account on the target WordPress site running Academy LMS before version 3.8.3, or use an existing low-privilege account.
2. Enumerate Lesson IDs: Identify lesson post IDs by browsing publicly visible course pages, inspecting page source, or querying the WordPress REST API for publicly listed content to enumerate lesson identifiers.
3. Craft REST API Request: Send an authenticated GET request to the Academy LMS lessons REST API endpoint (e.g., /wp-json/academy/v1/lessons/{lesson_id}) using the Subscriber account's authentication credentials (cookie or application password).
4. Access Unauthorized Content: The API returns the full lesson content without verifying enrollment status or publication state, exposing paid course lessons and unpublished drafts to the attacker (WPScan).

• Network: Unusual volume of authenticated REST API requests to /wp-json/academy/v1/lessons/ endpoints from a single Subscriber-level user account, especially targeting multiple lesson IDs in rapid succession.
• Logs: WordPress access logs showing repeated GET requests to the Academy LMS lessons REST API endpoint (/wp-json/academy/v1/lessons/*) from accounts with no corresponding course enrollment records.
• Application: Subscriber-level user accounts accessing lesson content for paid or unpublished courses with no enrollment or purchase history in the Academy LMS database.

Site administrators should update the Academy LMS WordPress plugin to version 3.8.3 or later, which introduces proper enrollment and publication status verification in the REST API (WPScan). As a temporary workaround, administrators can disable open user registration to prevent unenrolled users from obtaining Subscriber accounts, or restrict REST API access using a security plugin or server-level rules. Implementing proper enrollment verification checks before exposing lesson content through REST API endpoints is the recommended long-term fix (GitHub Advisory).