Academy LMS – WordPress LMS Plugin for Complete eLearning Solution vulnerabilities

3 known vulnerabilities in Academy LMS – WordPress LMS Plugin for Complete eLearning Solution from Kodezen. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Academy LMS – WordPress LMS Plugin for…: Authorization Bypass Through User-Controlled Key

  CVE-2025-15521Jan 21, 2026Kodezen

  The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.5.0. This is due to the plugin not properly validating a user's ident

• 7.2 High severity

  Academy LMS – WordPress LMS Plugin for…: Deserialization of Untrusted Data

  CVE-2025-12099Nov 8, 2025Kodezen

  The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.8 via deserialization of untrusted input in the 'import_all_courses' function. This make

• 8.8 High severity

  Academy LMS – WordPress LMS Plugin for…: Improper Privilege Management

  CVE-2024-1505Mar 13, 2024Kodezen

  The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. This is due to plugin allowing arbitrary user meta updates through the saved_user_info