---
id: "CVE-2026-120544"
kind: "vulnerability"
aliases: ["CVE-2026-120544"]
title: "WordPress Academy LMS plugin: directory traversal reads arbitrary .html files"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["academy-lms", "package", "self-hosted", "wordpress"]
not_affected_if: ["auth-required", "plugin-not-installed"]
published_at: "2026-11-03T05:18:32+00:00"
first_seen_at: "2026-11-03T05:48:53+00:00"
updated_at: "2026-11-03T05:50:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120544", "first_seen_at": "2026-11-03T05:48:53+00:00"}]
---

# WordPress Academy LMS plugin: directory traversal reads arbitrary .html files

The Academy LMS WordPress plugin up to and including 4.0.1 fails to restrict the 'id' parameter, allowing directory traversal. An authenticated contributor can read the full contents of any .html file on the server through the REST API response.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Academy LMS plugin is installed and its version is `4.0.1` or lower.
- Confirm contributor-level or higher accounts exist on the site that could be abused.

## Timeline

- 2026-11-03T05:48:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120544

## From the sources

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the attacker-supplied path before reading it, so files with any other extension — including wp-config.php — are out of reach. The file's contents are returned in full in the REST JSON response's content field.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_