CVE-2026-12376 Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above enrolled in any single course to read every user's quiz attempts across the whole site, including personal data su...

PT-2026-66685

Name of the Vulnerable Software and Affected Versions Academy LMS WordPress plugin versions prior to 3.8.3 Description An improper access control issue allows any authenticated user with subscriber-level access or higher who is enrolled in at least one course to access quiz attempt records...