CVE-2026-12376

CVE-2026-12376 affects the Academy LMS WordPress plugin up to version 3.8.2. The vulnerability is an access-control flaw in the quiz_attempts REST endpoint that allows any authenticated user with subscriber-level access (and enrolled in any single course) to read all users’ quiz attempts across t...