CVE-2025-11086
Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-22

Last updated on: 2025-10-22

Assigner: Wordfence

Description
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.7. This is due to the plugin not properly validating a user's role prior to registering a user via the Social Login addon. This makes it possible for unauthenticated attackers to update their role to Administrator when registering on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-10-22
Last Modified
2025-10-22
Generated
2026-07-06
AI Q&A
2025-10-22
EPSS Evaluated
2026-07-05
NVD
CVE-2025-11086
EUVD
EUVD-2025-35359

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
academy_lms wordpress_lms_plugin *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Mitigation Strategies

Update the Academy LMS WordPress plugin to version 3.3.8 or later, as this version includes fixes that address the privilege escalation vulnerability present in versions up to and including 3.3.7. [1]

Executive Summary

The vulnerability in the Academy LMS WordPress plugin allows unauthenticated attackers to escalate their privileges by exploiting improper validation of user roles during registration via the Social Login addon. This means attackers can register on the site and assign themselves the Administrator role without authorization.

Impact Analysis

This vulnerability can allow attackers to gain Administrator access to your WordPress site without authentication. With Administrator privileges, attackers can fully control the site, including modifying content, managing users, installing malicious code, and potentially compromising the entire system's security and integrity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-11086. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart