The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all ve…

The Academy LMS WordPress plugin is vulnerable to privilege escalation via account takeover in versions up to 3.5.0. The vulnerability stems from improper user identity validation before password updates and reliance on publicly-exposed nonces for authorization. Unauthenticated attackers can exploit this to change arbitrary user passwords, including administrators, and gain unauthorized access to accounts.