CVE-2025-15521
Privilege Escalation in Academy LMS Plugin via Password Reset Flaw
Publication date: 2026-01-21
Last updated on: 2026-01-21
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | academy_lms | to 3.5.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Academy LMS WordPress plugin allows an unauthenticated attacker to escalate privileges by taking over user accounts. It occurs because the plugin does not properly validate a user's identity before allowing a password update and relies only on a publicly-exposed nonce for authorization. As a result, attackers can change the password of any user, including administrators, and gain access to their accounts.
How can this vulnerability impact me? :
The vulnerability can have severe impacts as it allows attackers to gain unauthorized access to user accounts, including administrator accounts. This can lead to full control over the affected WordPress site, enabling attackers to manipulate content, steal sensitive information, install malicious code, or disrupt site operations.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Academy LMS WordPress plugin to a version later than 3.5.0 where the vulnerability is fixed. Until an update is available, restrict access to the plugin and monitor for unauthorized password changes, especially for administrator accounts. Avoid relying on the plugin's nonce-based authorization as it is publicly exposed and insufficient. Consider disabling the plugin temporarily if possible to prevent exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to escalate privileges by taking over accounts, including administrators, through password changes without proper identity validation. This unauthorized access can lead to exposure or manipulation of sensitive user data, potentially violating data protection regulations such as GDPR and HIPAA that require strict access controls and protection of personal information. Therefore, this vulnerability negatively impacts compliance with these standards by undermining user authentication and data security.