Live › vulnerability › CVE-2026-120544
The Academy LMS WordPress plugin up to and including 4.0.1 fails to restrict the 'id' parameter, allowing directory traversal. An authenticated contributor can read the full contents of any .html file on the server through the REST API response.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 05:48 UTC. All times on this page are UTC.
Sites running the Academy LMS plugin version 4.0.1 or earlier where users with contributor access or above exist. Attackers need an account, and the plugin only reads files ending in .html, so wp-config.php is not reachable by this route.
No product ranges from the sources yet.
4.0.1 or lower.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the attacker-supplied path before reading it, so files with any other extension — including wp-config.php — are out of reach. The file's contents are returned in full in the REST JSON response's content field.
This page as .md · .json · in your agent: get_signal("CVE-2026-120544")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.