CVE-2026-12376 Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above enrolled in any single course to read every user's quiz attempts across the whole site, including personal data su...

PT-2026-66685

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above enrolled in any single course to read every user's quiz attempts across the whole site, including personal data su...