CVE-2026-104022: CWE-269 Improper Privilege Management in kodezen Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning

CVE-2026-104022 is a privilege escalation vulnerability in the Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning WordPress plugin (versions <=4.0.3). The vulnerability arises from the 'add_child()' function calling 'add_role('academy_student')' on any account resolved from an attacker-supplied email before the 'Store::link()' function validates the guardian-ward relationship. If 'Store::link()' returns an error (e.g., when a guardian tries to link to their own account), the role assignment is not rolled back, resulting in permanent elevation to the 'academy_student' role. This role grants 'edit_posts' and, if enabled, 'upload_files' capabilities, which are not normally available to the guardian role. The flaw allows authenticated users with at least the 'academy_guardian' role to escalate privileges improperly.

Authenticated users with the 'academy_guardian' role or higher can escalate privileges to gain 'academy_student' role capabilities, including editing posts and uploading files (if enabled). This increases their permissions beyond intended limits, potentially allowing unauthorized content modification and file uploads. The vulnerability does not allow privilege escalation from unauthenticated users and does not impact system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to users with the 'academy_guardian' role or higher and monitor for suspicious role changes. Avoid enabling the student file-upload setting if possible to reduce risk. Review user roles regularly to detect unauthorized privilege escalations.