CVE-2026-9341 is an insecure direct object reference vulnerability (CWE-639) in the Academy LMS WordPress plugin for eLearning. The vulnerability exists in the 'save_lesson_note', 'get_lesson_note', and 'complete_lesson_video' AJAX handlers, which do not properly validate a user-controlled key parameter. This lack of validation enables authenticated attackers with low privileges (Subscriber-level and above) to access and manipulate private lesson notes and lesson completion progress of other users without authorization.

An attacker with Subscriber-level access can read, overwrite, or delete private lesson notes belonging to any user, including administrators. Additionally, the attacker can falsify lesson completion progress for arbitrary users. This compromises data integrity and privacy within the LMS environment but does not directly impact system availability or confidentiality beyond the described scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only and monitor for suspicious activity related to lesson notes and completion progress. Avoid granting Subscriber-level or higher access to untrusted users.