Critical · published January 21, 2026
🚨 Wow, an unauthenticated attacker could reset any user's password—including admins—just by exploiting a nonce! This is a major oversight in the Academy LMS plugin for WordPress! 🔥 Think of it as a hotel where anyone can walk up to the front desk and request a new key for any room simply by saying the name—no ID check required! What a recipe for disaster! An attacker could seize control of any account, including those of administrators, leading to unauthorized access to sensitive data and settings. This could result in full chaos, from altering course materials to deleting crucial files—that’s an absolute nightmare for any educational institution!
Think of it as a hotel where anyone can walk up to the front desk and request a new key for any room simply by saying the name—no ID check required! What a recipe for disaster! The vulnerability stems from the Academy LMS plugin not properly validating user identity before allowing password changes, relying solely on an exposed nonce for authorization. This gap opens the door wide for attackers to hijack accounts without any authentication.
An attacker could seize control of any account, including those of administrators, leading to unauthorized access to sensitive data and settings. This could result in full chaos, from altering course materials to deleting crucial files—that’s an absolute nightmare for any educational institution! Immediately update the Academy LMS plugin to version 3.5.1 or later. Ensure that password reset mechanisms implement proper user verification to prevent unauthorized changes. It's also wise to audit user permissions to safeguard against any potential misuse. 🔒 You've got this! Follow these steps to keep your systems secure and regain your hero status as a guardian of the internet! 🛡️