CVE-2026-104050: CWE-639 Authorization Bypass Through User-Controlled Key in Academy LMS

CVE-2026-104050 is an authorization bypass vulnerability in the Academy LMS WordPress plugin prior to version 4.0.0. The flaw arises from the plugin failing to verify that a quiz question requested by an authenticated user belongs to a course the user is authorized to access. As a result, any authenticated user with access to at least one course can retrieve quiz answer options from questions in other courses they are not enrolled in, potentially exposing sensitive quiz content across courses.

The vulnerability allows unauthorized disclosure of quiz answer options across different courses within the Academy LMS plugin. This could undermine the integrity of assessments by exposing correct answers to users not enrolled in those courses. There is no indication of remote code execution or privilege escalation beyond this information disclosure. No known exploits are reported in the wild at this time.

A fixed version 4.0.0 or later of the Academy LMS plugin should be applied to remediate this vulnerability. Since no patch links are provided in the input data, users should verify with the official plugin source for updates. Until patched, restrict plugin access to trusted users and consider disabling quiz answer option visibility if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.