CVE-2026-25372: 
WordPress vulnerability analysis and mitigation

CVE-2026-25372 is a Missing Authorization vulnerability in the Academy LMS WordPress plugin developed by Kodezen LLC. It allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels, classified under CWE-862 (Missing Authorization). The vulnerability affects Academy LMS versions from n/a through 3.5.3 (inclusive). It was published on February 19, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The root cause is a Missing Authorization flaw (CWE-862), where the Academy LMS plugin fails to properly verify whether a requesting user has the appropriate permissions before executing certain actions. An authenticated attacker with low-level privileges can send crafted network requests to exploit incorrectly configured access control checks, bypassing intended authorization gates. No user interaction is required, and the attack complexity is low, making it straightforward to exploit once an attacker has any authenticated foothold on the WordPress site (Feedly, Patchstack).

Successful exploitation results in a high integrity impact, allowing an attacker to perform unauthorized actions within the Academy LMS plugin — such as modifying course content, user enrollments, or plugin settings — without proper authorization. Confidentiality and availability are not directly impacted according to the CVSS scoring. The scope is limited to the affected system, but unauthorized data modification could undermine the integrity of the e-learning platform and its users' records (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-25372 as of the available data. The vulnerability requires low-privilege authentication, reducing but not eliminating the barrier to exploitation. The EPSS score is approximately 0.017% (0.000170), indicating a low probability of exploitation in the near term. It does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Users should update the Academy LMS WordPress plugin to a version beyond 3.5.3, as all versions up to and including 3.5.3 are affected. Site administrators should check the WordPress plugin repository or the Kodezen LLC vendor page for the latest patched release and apply it promptly. As an interim measure, restricting plugin access to trusted roles only and auditing user permissions on the WordPress site can reduce exposure (Patchstack).