CVE-2026-5348 is an insecure direct object reference vulnerability (CWE-639) in the Academy LMS WordPress plugin for eLearning. The vulnerability arises because the '/topics' REST API endpoint is registered with a permission callback that always returns true, allowing unauthenticated users to retrieve course curriculum data. This lack of proper authorization checks means that sensitive course content for non-public courses can be accessed without authentication by enumerating course IDs. The vulnerability affects versions up to and including 3.8.1. No official patch or remediation guidance has been provided in the available data.

An unauthenticated attacker can access detailed curriculum information for private, draft, scheduled, or password-protected courses. This leads to unauthorized disclosure of potentially sensitive educational content. There is no indication of impact on data integrity or availability. The CVSS 3.1 base score is 5.3 (medium severity), reflecting the network attack vector, low complexity, no privileges required, no user interaction, and confidentiality impact only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the REST API endpoints or disable the vulnerable '/topics' endpoint if possible. Monitor for updates from the vendor and apply official patches once released.