Threats Tagged 'ghsa-qhx6-xfpm-926j'

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning WordPress plugin contains an authorization bypass vulnerability in all versions up to and including 4.0.3. Authenticated users with custom-level access or higher, registered as instructors for at least one course, can exploit this flaw to delete lesson comments and replies authored by any user, including administrators, across courses they do not instruct. This occurs because the plugin fails to properly verify user authorization for the delete action.