https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 03:46:03 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-332312 EUVD-2026-332312 https://cve.radiocsirt.org/vuln/euvd-2026-332312 https://cve.radiocsirt.org/vuln/fkie_cve-2026-5348 <p>The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.8.1. This is due to the &#39;/topics&#39; REST API endpoint being registered with a permission callback set to &#39;__return_true&#39;, allowing unauthenticated access to course curriculum data without verifying the course&#39;s post status or user enrollment. This makes it possible for unauthenticated attackers to access detailed curriculum information for private, draft, scheduled, or password-protected courses by enumerating course IDs.</p> <p>The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.8.1. This is due to the &#39;/topics&#39; REST API endpoint being registered with a permission callback set to &#39;__return_true&#39;, allowing unauthenticated access to course curriculum data without verifying the course&#39;s post status or user enrollment. This makes it possible for unauthenticated attackers to access detailed curriculum information for private, draft, scheduled, or password-protected courses by enumerating course IDs.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-5348 https://cve.radiocsirt.org/vuln/ghsa-p8p5-g7rx-q44c <p>The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.8.1. This is due to the &#39;/topics&#39; REST API endpoint being registered with a permission callback set to &#39;__return_true&#39;, allowing unauthenticated access to course curriculum data without verifying the course&#39;s post status or user enrollment. This makes it possible for unauthenticated attackers to access detailed curriculum information for private, draft, scheduled, or password-protected courses by enumerating course IDs.</p> <p>The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.8.1. This is due to the &#39;/topics&#39; REST API endpoint being registered with a permission callback set to &#39;__return_true&#39;, allowing unauthenticated access to course curriculum data without verifying the course&#39;s post status or user enrollment. This makes it possible for unauthenticated attackers to access detailed curriculum information for private, draft, scheduled, or password-protected courses by enumerating course IDs.</p> https://cve.radiocsirt.org/vuln/ghsa-p8p5-g7rx-q44c