High severity · published Mar 13, 2024
CVE-2024-1505
Academy LMS – eLearning and online course solution for WordPress <= 1.9.19 - Authenticated (Subscriber+) Privilege Escalation
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. This is due to plugin allowing arbitrary user meta updates through the saved_user_info() function. This makes it possible for authenticated attackers, with minimal permissions such as students, to elevate their user role to that of an administrator.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AL
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution · kodezen
through 1.9.19 · source: vendor
AL
Academy Lms · Kodezen
before 1.9.20 · source: NVD, CISA
Affected product
AL
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
kodezen
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1505
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1505
Patch
https://plugins.trac.wordpress.org/changeset/3037880/academy#file473
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/b150f90a-ccb7-4c19-a4b3-eaf9ec264ba8?source=cve
More from Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
9.8
CVE-2025-15521
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover
7.2
CVE-2025-12099
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'
5.3
CVE-2026-5348
Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure