CVE-2026-14184

The Academy LMS WordPress plugin version prior to 3.8.1 contains an authorization bypass vulnerability due to a failure to verify ownership of user-supplied identifiers in several lesson AJAX handlers . This allows authenticated users with subscriber-level access to perform unauthorized actions, ...