Skip to content
PluginCanary

Academy LMS

Fewer than 10 active installs · Checked 3 Nov 2026
Avoid1 Critical6 Warnings

Avoid: Academy LMS is closed on wordpress.org and no longer gets updates.

10/ 100 Canary Score

Capped at 10 because the plugin is closed.

Sub-scores for Academy LMS
Ownership100
Maintenance10
Security0
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • CriticalSEC-2Vulnerability published 4 Aug 2026 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.18 Aug 2026Evidence
  • WarningCLS-1Closed on wordpress.org on 11 Oct 2026, reason: false. Replace this plugin. It no longer receives updates from wordpress.org.11 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 9 Oct 2026, fixed in 4.0.4. Update to version 4.0.4 or later.9 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 9 Oct 2026, fixed in 4.0.4. Update to version 4.0.4 or later.9 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 5 Oct 2026, fixed in 4.0.0. Update to version 4.0.0 or later.5 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 5 Oct 2026, fixed in 4.0.0. Update to version 4.0.0 or later.5 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 2 Oct 2026, fixed in 4.0.2. Update to version 4.0.2 or later.2 Oct 2026Evidence
  • InfoSEC-315 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Commit history is collected for plugins with 1,000+ installs or on a watchlist. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
not recorded
Releases, 24 months
0
Tested up to
not stated vs 7.1
Requires PHP
not stated supported 8.2+

Release history builds as we see new versions.

Support

Support history appears after our first snapshots of the forum counts.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
9 Oct 2026Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id6.5<= 4.0.34.0.4n/a
9 Oct 2026Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint5.4<= 4.0.34.0.4n/a
5 Oct 2026Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference4.3<= 3.0.04.0.0n/a
5 Oct 2026Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference4.3<= 3.0.04.0.0n/a
2 Oct 2026Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route4.3<= 4.0.14.0.2n/a
4 Aug 2026Academy LMS <= 3.8.2 - Authenticated (Subscriber+) Information Exposure4.3<= 3.8.2No fixn/a
24 Jul 2026Academy LMS <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Lesson Content Disclosure4.3<= 3.8.23.8.3n/a
13 Jul 2026Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter4.3<= 3.8.03.8.1n/a
1 Jul 2026Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure5.3<= 3.8.13.8.2n/a
30 Jun 2026Academy LMS <= 3.8.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Note/Progress Modification4.3<= 3.8.03.8.1n/a
17 Feb 2026Academy LMS <= 3.5.3 - Missing Authorization4.3<= 3.5.33.5.4n/a
20 Jan 2026Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover9.8<= 3.5.03.5.1n/a
30 Dec 2025Academy LMS <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.4.03.4.1n/a
7 Nov 2025Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'7.2<= 3.3.83.3.9n/a
22 Sep 2025Academy LMS <= 3.3.4 - Authenticated (Academy Instructor+) Insecure Direct Object Reference4.3<= 3.3.43.3.5n/a
11 Jul 2024Academy LMS <= 2.0.4 - Missing Authorization2.7<= 2.0.42.0.5n/a
21 Jun 2024Academy LMS <= 2.0.10 - Open Redirect8.3<= 2.0.102.0.11n/a
10 May 2024Academy LMS <= 1.9.25 - Unauthenticated Sensitive Information Exposure5.3<= 1.9.251.9.26n/a
29 Apr 2024Academy LMS <= 1.9.16 - Missing Authorization4.3<= 1.9.161.9.17n/a
22 Apr 2024Academy LMS <= 1.9.16 - Missing Authorization5.4<= 1.9.161.9.17n/a
21 Feb 2024Academy LMS – eLearning and online course solution for WordPress <= 1.9.19 - Authenticated (Subscriber+) Privilege Escalation8.8<= 1.9.191.9.20n/a

Source: Wordfence Intelligence.

Reputation

No ratings yet.

Momentum

Fewer than 10 active installs. History builds with each weekly snapshot.

Momentum history builds with each snapshot.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

No healthier plugin in the same category yet.

Facts

Versionnot stated
Authornot stated
Addednot stated
Last updatednot stated
Active installsFewer than 10
Requires WordPressnot stated
Tested up tonot stated
Requires PHPnot stated
CategoryLearning Management Systems (LMS) > Course Creation & Management
Tagsnot stated

Questions

Is Academy LMS still maintained?

No. Academy LMS was closed on wordpress.org on 11 Oct 2026 (false) and gets no updates there.

Is Academy LMS safe?

Academy LMS has 1 published vulnerability with no patched version. Its Canary status is Avoid.

Who owns Academy LMS?

The wordpress.org author is not listed. We have recorded no ownership change.

What can I use instead of Academy LMS?

We have no healthier plugin in the same category on record yet.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue