CVE-2026-104049: CWE-639 Authorization Bypass Through User-Controlled Key in Academy LMS

CVE-2026-104049 is an authorization bypass vulnerability in the Academy LMS WordPress plugin prior to version 4.0.0. The flaw arises because the plugin fails to verify whether a user is enrolled in a course or owns the requested lesson object when serving lesson content through one of its REST API endpoints. Consequently, any user with a self-registered student account can retrieve the full content of lessons from paid or private courses without proper authorization.

Unauthorized users can access lesson content from paid or private courses they are not enrolled in, potentially exposing proprietary or restricted educational materials. This compromises the confidentiality of course content but does not indicate privilege escalation or code execution.

Upgrade the Academy LMS WordPress plugin to version 4.0.0 or later, where this authorization bypass vulnerability has been addressed. Patch status is implied by the affected version range indicating versions before 4.0.0 are vulnerable. No vendor advisory was provided, so check the plugin's official release notes or repository for confirmation and updates.