Threats tagged 'ghsa-9988-37r6-j7j6'

Academy LMS WordPress plugin versions before 3.8.3 have an improper access control vulnerability in their REST API. This flaw allows users with Subscriber-level accounts to access lesson content without verifying enrollment or lesson publication status. As a result, unauthorized users can view lessons from paid courses they are not enrolled in, including unpublished lessons in draft, pending, or private states.