Is it permissible for a hacker who discovered vulnerabilities in paid educational websites and downloaded and published or sold their lessons, then informed the website owners of these vulnerabilities in exchange for money, to continue this work, and is the money earned lawful?

The fundamental principle regarding hacking websites and acquiring content not made publicly available is that it is forbidden, except in narrow cases, such as hacking the websites of criminals and those waging war [against Islam/Muslims]. Taking non-free educational materials and selling them is forbidden, the sale is invalid, and the money acquired from it is unlawful and must be disposed of. If it is possible to identify a vulnerability without hacking the website and causing damage, and then inform the website owners about it and request a fee for resolving it, there is no harm in that. However, if discovering the vulnerability requires actual hacking, then this is not permissible except with the permission of the website owner.