CVE-2024-38701
📋 TL;DR
This vulnerability allows attackers to bypass authorization controls in Academy LMS WordPress plugin by manipulating user-controlled keys. It affects all Academy LMS installations from unknown versions through 2.0.4. Attackers could access restricted functionality or data they shouldn't have permission to view.
💻 Affected Systems
- Academy LMS WordPress Plugin
📦 What is this software?
Academy Lms by Kodezen
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to the LMS system, modify course content, access sensitive student data, or compromise the entire WordPress installation.
Likely Case
Unauthorized users access student records, course materials, or administrative functions they shouldn't have permission to view.
If Mitigated
Minimal impact with proper network segmentation, strong authentication, and monitoring in place.
🎯 Exploit Status
Requires some level of user access to manipulate keys, but exploitation is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.5 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/academy/wordpress-academy-lms-plugin-2-0-4-broken-access-control-vulnerability
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Academy LMS and click 'Update Now'. 4. Verify update to version 2.0.5 or later.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the vulnerable plugin until patched
wp plugin deactivate academy
Access Restriction
linuxRestrict access to WordPress admin area using IP whitelisting
# Add to .htaccess for Apache: Order Deny,Allow\nDeny from all\nAllow from 192.168.1.0/24
# Add to nginx config: allow 192.168.1.0/24;\ndeny all;
🧯 If You Can't Patch
- Implement strict role-based access controls and audit all user permissions
- Enable detailed logging and monitoring for unauthorized access attempts to sensitive LMS functions
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Academy LMS version. If version is 2.0.4 or earlier, system is vulnerable.Check Version:
wp plugin get academy --field=versionVerify Fix Applied:
Verify Academy LMS plugin version is 2.0.5 or later in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to admin functions
- User role escalation attempts
- Access to restricted course/student data by non-authorized users
Network Indicators:
- Unusual API calls to LMS endpoints
- Requests with manipulated parameter values
SIEM Query:
source="wordpress.log" AND ("academy_lms" OR "academy-plugin") AND ("unauthorized" OR "permission denied" OR "access control")