The Academy LMS WordPress plugin prior to version 3.8.3 does not properly enforce access controls when returning individual lesson data via its REST API. Specifically, it fails to verify whether a requesting user is enrolled in the course or whether the lesson is published. This allows users with Subscriber-level privileges to retrieve content from arbitrary lessons, including those from paid courses they have not purchased and lessons that are unpublished (draft, pending, or private). The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS v3.1 base score of 6.5, indicating a medium severity level. No official patch or remediation guidance is currently provided in the available data.

Unauthorized disclosure of lesson content can occur, exposing paid course materials and unpublished lessons to users without proper enrollment or permissions. This compromises the confidentiality of course content and may impact the business model of content providers using Academy LMS. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user access where possible and monitor for unauthorized access attempts. Avoid exposing the REST API endpoints publicly if feasible.