CVE-2026-104915

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to permanently delete arbitrary Academy lesson comments and their replies authored by any user, including administrators, across courses they do not instruct. This is exploitable by any user registered as an Academy instructor for at least one course, as they can supply their own course_id to pass the instructor check while targeting comments belonging to entirely different courses.

• CWE-862

• https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php#L469
• https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php#L477
• https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php#L480
• https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php#L496
• https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/classes/abstract-ajax-handler.php#L43
• https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/traits/courses.php#L380
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3734598%40academy&new=3734598%40academy
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2640d1f8-958d-4556-919c-58df5bf15b40?source=cve

Published

Oct 10, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104907MISP contains a cross-site scripting (XSS) vulnerability in …4.8
• CVE-2026-104908MISP contains an improper input validation vulnerability in …7.1
• CVE-2026-104909The Mang Board plugin for WordPress is vulnerable to Local F…8.1
• CVE-2026-104910MISP contains an authorization bypass in the related events …5.3
• CVE-2026-104912MISP contains an authorization flaw in its correlation handl…7.1
• CVE-2026-104914MISP contains an improper access control vulnerability in it…5.3
• CVE-2026-104922Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-104932The Search Regex plugin for WordPress is vulnerable to PHP O…8
• CVE-2026-104935Authentication bypass by spoofing in ICS before version 25.1…8.6
• CVE-2026-104937Shopware version 6.7 allows the upload of attacker‑controlle…
• CVE-2026-104939Description NGINX Ingress Controller has a vulnerability whe…7.5
• CVE-2026-104944TP-Link Tapo C500 v2.0 contains an out-of-bounds function-po…7.1