CVE-2026-120544
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the attacker-supplied path before reading it, so files with any other extension — including wp-config.php — are out of reach. The file's contents are returned in full in the REST JSON response's content field.
Key facts
- CVSS score
- 4.3 (v3.1)
- Severity
- MEDIUM
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
- CWE-22
- EPSS score
- 0.3% (28th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2026-115660)
- Published
- November 3, 2026
- NVD last modified
- November 3, 2026
- Status
- Deferred
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2026-115660 in the EU Vulnerability Database. Last updated in EUVD on November 3, 2026.
View on the EU Vulnerability DatabaseReferences
- https://plugins.trac.wordpress.org/browser/academy/tags/4.0.1/includes/frontend/template/block.php#L12
- https://plugins.trac.wordpress.org/browser/academy/tags/4.0.1/includes/frontend/template/block.php#L267
- https://plugins.trac.wordpress.org/browser/academy/tags/4.0.1/includes/frontend/template/block.php#L30
- https://plugins.trac.wordpress.org/browser/academy/tags/4.0.1/includes/frontend/template/block.php#L50
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3723396%40academy&new=3723396%40academy
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1f0a1439-d10c-4dfc-9a40-7319debe3c51?source=cve
Last updated November 4, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain