This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis →
Q1What is this vulnerability? (Essence + Consequences)
🚨 **Essence**: A critical identity verification flaw in the password reset flow. 📉 **Consequences**: Attackers can hijack accounts, leading to full system compromise, data theft, and unauthorized changes.…
🛡️ **Root Cause**: CWE-639 (Authorization Bypass Through User-Controlled Key). 🔍 **Flaw**: The plugin fails to properly verify user identity before updating passwords.…
📦 **Vendor**: Kodezen. 📦 **Product**: Academy LMS – WordPress LMS Plugin for Complete eLearning Solution. 📅 **Affected Versions**: 3.5.0 and earlier. ⚠️ **Platform**: WordPress.
Q4What can hackers do? (Privileges/Data)
💀 **Privileges**: Full account takeover. 📂 **Data**: Access to sensitive user data, course progress, and potentially admin credentials. 🔄 **Impact**: High (CVSS 9.8).…
📉 **Threshold**: LOW. 🔓 **Auth**: None required (PR:N). 🖱️ **UI**: No user interaction needed (UI:N). 🌐 **Network**: Remote (AV:N). 🎯 **Complexity**: Low (AC:L). This is an easy, remote exploit for anyone.
Q6Is there a public Exp? (PoC/Wild Exploitation)
🚫 **Public Exp**: No PoC provided in the data. 🔍 **Status**: Theoretical but highly likely given the CVSS score and nature of the flaw. ⚠️ **Risk**: Wild exploitation is imminent due to low barrier to entry.
Q7How to self-check? (Features/Scanning)
🔍 **Check**: Scan for 'Academy LMS' plugin version ≤ 3.5.0. 🛠️ **Feature**: Look for the password reset function in `includes/functions.php` around line 1581.…
✅ **Fixed**: Yes. 📅 **Patch Date**: Published 2026-01-21. 🔄 **Action**: Update to a version newer than 3.5.0. 📝 **Ref**: See WordFence and WordPress Trac links for official details.
Q9What if no patch? (Workaround)
🛑 **Workaround**: Disable the plugin if not essential. 🚫 **Restrict**: Limit access to the LMS module. 🔄 **Manual**: Monitor for unauthorized password reset requests.…