CVE-2015-10139
BaseFortify
Publication date: 2025-07-19
Last updated on: 2025-12-16
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vibethemes | wordpress_learning_management_system_ | From 1.5.2 (inc) to 1.8.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo | |
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the WPLMS theme to a version later than 1.8.4.1 where the vulnerability is fixed, restricting access to authenticated users with appropriate privileges, and monitoring or disabling the 'wp_ajax_import_data' AJAX action if possible to prevent unauthorized privilege escalation. [1]
How can this vulnerability impact me? :
This vulnerability can allow an authenticated attacker to escalate their privileges to administrator level by modifying restricted settings. This can lead to unauthorized access to the WordPress admin area, creation of new admin accounts, disruption of admin notifications, and changes to user registration settings, potentially compromising the entire website's security and control. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves verifying if the WordPress site is using the WPLMS theme versions 1.5.2 to 1.8.4.1 and checking for unauthorized changes to system options such as administrator email, user registration settings, or default user roles. Specific commands are not provided, but monitoring changes to these settings or auditing AJAX requests to 'wp_ajax_import_data' could help detect exploitation attempts. [1]
Can you explain this vulnerability to me?
CVE-2015-10139 is a privilege escalation vulnerability in the WordPress WPLMS theme versions 1.5.2 to 1.8.4.1. It occurs due to insufficient validation in the 'wp_ajax_import_data' AJAX action, specifically in the import_data function. This flaw allows any authenticated user, regardless of their privilege level, to modify restricted system settings, such as changing the administrator's email, re-enabling user registration, and setting the default user role to administrator, thereby potentially creating a new admin account. [1]