CVE-2026-12153
Received Received - Intake

Authorization Bypass in WP Learn Manager Plugin

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: Wordfence

Description
The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins from the WordPress.org repository on the vulnerable site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-08
Last Modified
2026-07-08
Generated
2026-07-08
AI Q&A
2026-07-08
EPSS Evaluated
N/A
NVD
CVE-2026-12153
EUVD
EUVD-2026-42172

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_learn_manager plugin to 1.1.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WP Learn Manager plugin for WordPress has an authorization bypass vulnerability in all versions up to and including 1.1.8. This means the plugin does not properly check if a user is authorized to perform certain actions.

Because of this flaw, unauthenticated attackers can exploit the vulnerability to install and activate arbitrary plugins from the WordPress.org repository on the affected site.

Impact Analysis

This vulnerability can have severe impacts because it allows attackers with no authentication to install and activate any plugin on the vulnerable WordPress site.

Such unauthorized plugin installations can lead to full site compromise, including data theft, site defacement, or further malware installation.

The CVSS score of 9.8 indicates a critical severity with high impact on confidentiality, integrity, and availability.

Mitigation Strategies

To mitigate this vulnerability, you should update the WP Learn Manager plugin to a version later than 1.1.8 where the authorization bypass issue is fixed.

Until an update is applied, restrict access to the plugin management features and monitor for unauthorized plugin installations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12153. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart