CVE-2026-16563 is an improper access control vulnerability (CWE-284) in the Academy LMS WordPress plugin prior to version 3.8.3. The plugin's REST API endpoint for retrieving a single lesson fails to check whether the requesting user is enrolled in the course or whether the lesson is published. As a result, users with Subscriber-level (student) accounts can access arbitrary lesson content, including paid and unpublished lessons, which should be restricted. This exposure violates intended access controls and could lead to unauthorized disclosure of course materials.

Unauthorized users with Subscriber-level accounts can access lesson content they are not entitled to view. This includes lessons from paid courses without enrollment and lessons that are unpublished (draft, pending, or private). The exposure of such content can lead to intellectual property leakage and undermine course monetization and content confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user access to the REST API or disable the vulnerable API endpoints if possible. Monitor vendor channels for updates and apply patches promptly once released.