CVE-2026-5348 describes an authorization bypass vulnerability (CWE-639) in the Academy LMS WordPress plugin for versions up to and including 3.8.1. The vulnerability arises because the '/topics' REST API endpoint is registered with a permission callback that always returns true, effectively disabling access control. As a result, unauthenticated attackers can access course curriculum data for courses that should be restricted, including private, draft, scheduled, or password-protected courses, by enumerating course IDs. This leads to unauthorized disclosure of course content.

An attacker without any authentication can access detailed curriculum information for courses that are intended to be private or restricted. This unauthorized data disclosure can compromise the confidentiality of course materials and potentially affect the privacy of course content and user enrollment information. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the REST API endpoints or implement custom permission callbacks to enforce proper authorization checks on the '/topics' endpoint. Monitor vendor communications for updates and apply patches promptly once released.