{"id":"CVE-2026-120544","kind":"vulnerability","aliases":["CVE-2026-120544"],"related":[],"title":"WordPress Academy LMS plugin: directory traversal reads arbitrary .html files","description":"The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the attacker-supplied path before reading it, so files with any other extension — including wp-config.php — are out of reach. The file's contents are returned in full in the REST JSON response's content field.","summary":"The Academy LMS WordPress plugin up to and including 4.0.1 fails to restrict the 'id' parameter, allowing directory traversal. An authenticated contributor can read the full contents of any .html file on the server through the REST API response.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["academy-lms","package","self-hosted","wordpress"],"not_affected_if":["auth-required","plugin-not-installed"],"how_to_check":"- Check whether the Academy LMS plugin is installed and its version is `4.0.1` or lower.\n- Confirm contributor-level or higher accounts exist on the site that could be abused.","fix":null,"status":"open","published_at":"2026-11-03T05:18:32+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","triaged_at":"2026-11-03T05:50:02+00:00","updated_at":"2026-11-03T05:50:02+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T05:50:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WordPress Academy LMS plugin: directory traversal reads arbitrary .html files","impact":"low","summary":"The Academy LMS WordPress plugin up to and including 4.0.1 fails to restrict the 'id' parameter, allowing directory traversal. An authenticated contributor can read the full contents of any .html file on the server through the REST API response.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","academy-lms","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Contributor reads arbitrary .html files on the server","analyst_note":"Confirm the fixed version and vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-120544 and the plugin changelog.","how_to_check":"- Check whether the Academy LMS plugin is installed and its version is `4.0.1` or lower.\n- Confirm contributor-level or higher accounts exist on the site that could be abused.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","auth-required"],"who_is_affected":"Sites running the Academy LMS plugin version 4.0.1 or earlier where users with contributor access or above exist. Attackers need an account, and the plugin only reads files ending in .html, so wp-config.php is not reachable by this route.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000689,"input_tokens":4230,"output_tokens":532,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120544':13A,16A '-2026':12A,15A '4.0.1':34B,88C 'academi':2A,18B,26B,65C 'academy-lm':17B 'access':104C 'ai':67C 'allow':41B 'api':62B 'append':120C 'arbitrari':8A,112C 'attack':99C,127C 'attacker-suppli':126C 'authent':45B,98C 'builder':69C 'certif':71C 'content':51B,110C,148C,159C 'contributor':46B,102C 'contributor-level':101C 'cours':68C 'cve':11A,14A 'directori':5A,42B,79C 'elearn':72C 'extens':123C,138C 'fail':35B 'field':160C 'file':10A,55B,114C,134C,146C 'full':50B,152C 'host':23B 'html':9A,54B,113C,122C 'id':39B,91C 'includ':33B,87C,139C 'json':156C 'level':103C 'lms':3A,19B,27B,66C 'make':94C 'packag':20B 'paramet':40B,92C 'path':129C 'plugin':4A,29B,73C,119C 'possibl':96C 'quizz':70C 'reach':144C 'read':7A,48B,108C,131C 'respons':63B,157C 'rest':61B,155C 'restrict':37B 'return':150C 'self':22B 'self-host':21B 'server':58B,117C 'suppli':128C 'travers':6A,43B,80C 'version':83C 'via':89C 'vulner':77C 'wordpress':1A,24B,28B,75C 'wp-config.php':140C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Academy LMS plugin version 4.0.1 or earlier where users with contributor access or above exist. Attackers need an account, and the plugin only reads files ending in .html, so wp-config.php is not reachable by this route.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["academylms","medium","package","selfhosted","wordpress"],"first_public_at":"2026-11-03T05:18:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120544","severity":null,"published_at":"2026-11-03T05:18:32+00:00","modified_at":"2026-11-03T05:18:32+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","fetched_at":"2026-11-03T05:48:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}