CVE-2026-104022 | CVSS: 5.4 | 严重级别: MEDIUM
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the `add_child()` function calling `add_role('academy_student')` on any existing account resolved from the attacker-supplied `email` parameter before `Store::link()` validates the guardian-ward relationship, and failing to roll back that role write when `Store::link()` returns a `WP_Error`. This makes it possible for authenticated attackers with the `academy_guardian` role or higher to elevate any existing
参考链接:
• https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/guardian/
• https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/guardian/
• https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/guardian/
📌 数据来源: NVD 官方