CVE-2025-15521

Published Jan 21, 2026

Last updated 9 days ago

CVSS critical 9.8
lms

Overview

Description
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.5.0. This is due to the plugin not properly validating a user's identity prior to updating their password and relying solely on a publicly-exposed nonce for authorization. This makes it possible for unauthenticated attackers to change arbitrary user's password, including administrators, and gain access to their account.
Source
security@wordfence.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

security@wordfence.com
CWE-639

Social media

Hype score
Not currently trending

  1. #VulnerabilityReport #AcademyLMS CVE-2025-15521 (CVSS 9.8): Critical Academy LMS Flaw Exploited for Admin Takeover https://t.co/n5cqAF7b8F

    @Komodosec

    28 Feb 2026

    132 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. Critical Security Alert: CVE-2025-15521 A 9.8 CRITICAL vulnerability has been found in the Academy LMS WordPress plugin (up to v3.5.0). Unauthenticated attackers can take over ANY account, including administrators, by exploiting a password reset flaw. ✅ Action: Update to the

    @MNovofastovsky

    9 Feb 2026

    50 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. CRITICAL WORDPRESS ALERT: CVE-2025-15521 (CVSS 9.8) allows unauthenticated attackers to hijack ADMIN accounts in "The Academy LMS" plugin. 🔓 https://t.co/wfQQNmXdJ5 ⚠️ Affected: Versions ≤ 3.5.0 ⚡ Impact: Full Site Takeover PATCH NOW or disable the plugin immediate

    @MNovofastovsky

    8 Feb 2026

    60 Impressions

    1 Retweet

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Critical #WordPress Vulnerability — CVE-2025-15521 A serious privilege escalation flaw in the Academy LMS – WordPress LMS Plugin (≤ 3.5.0) lets unauthenticated attackers reset any user’s password, including administrators, by abusing improper identity validation — enab

    @MNovofastovsky

    6 Feb 2026

    42 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. CVE-2025-15521 (CVSS:9.8, CRITICAL) is Received. The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege e..https://t.co/8WWV7mtt9Q #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre

    @cracbot

    26 Jan 2026

    5 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. CVE-2025-15521: Critical Admin Takeover Vulnerability in Academy LMS Plugin Exposes Thousands of eLearning Sites Read the full report on - https://t.co/ankCf7hfdc https://t.co/on5stsg9vn

    @cyberbivash

    22 Jan 2026

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. CVE-2025-15521 The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions… https://t.co/mgcy8InWX6

    @CVEnew

    21 Jan 2026

    352 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  8. [CVE-2025-15521: CRITICAL] WordPress LMS Plugin for eLearning is at risk! The Academy LMS Plugin up to version 3.5.0 allows unauthorized attackers to change any user's password, including admins. Cybersecuri...#cve,CVE-2025-15521,#cybersecurity https://t.co/0yHIowUtgp https://t.c

    @CveFindCom

    21 Jan 2026

    84 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. 🚨 CVE-2025-15521: Academy LMS – WordPress LMS Plug... Academy LMS exposes admin access through a trivial nonce-only auth bypass - the password reset function lacks proper id... https://t.co/aDC46mQqJz #netsec #vulnerability #CVE #sysadmin #zeroday

    @0dayPublishing

    21 Jan 2026

    11 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to Time-based Blind SQL Injection via the 'order' and 'orderby' parameters in the /lms/stm-lms/order/items REST API endpoint in versions up to and including 3.7.25. This is due to insufficient input sanitization combined with a design flaw in the custom Query builder class that allows unquoted SQL injection in ORDER BY clauses. When the Query builder detects parentheses in the sort_by parameter, it treats the value as a SQL function and directly concatenates it into the ORDER BY clause without any quoting. While esc_sql() is applied to escape quotes and backslashes, this cannot prevent ORDER BY injection when the values themselves are not wrapped in quotes in the resulting SQL statement. This makes it possible for authenticated attackers, with subscriber-level access and above, to append arbitrary SQL queries via the ORDER BY clause to extract sensitive information from the database including user credentials, session tokens, and other confidential data through time-based blind SQL injection techniques.•CVE-2026-4817
  2. Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT /api/users/{id} endpoint allows any authenticated user with ROLE_STUDENT to escalate their privileges to ROLE_ADMIN by modifying the roles field on their own user record. The API Platform security expression is_granted('EDIT', object) only verifies record ownership, and the roles field is included in the writable serialization group, enabling any user to set arbitrary roles such as ROLE_ADMIN. Successful exploitation grants full administrative control of the platform, including access to all courses, user data, grades, and administrative settings. This issue has been fixed in version 2.0.0-RC.3.•CVE-2026-40291
  3. The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the 'InstructorsController::prepare_object_for_database' function. This makes it possible for authenticated attackers, with Student-level access and above, to elevate their privileges to that of an administrator.•CVE-2026-4484
  4. A vulnerability was identified in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. Impacted is the function recognizeMarkdown of the file yudao-module-digitalcourse/yudao-module-digitalcourse-biz/src/main/java/cn/iocoder/yudao/module/digitalcourse/util/Pdf2MdUtil.java. Such manipulation of the argument fileUrl leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.•CVE-2026-4285
  5. Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks if h5p.json exists but doesn't block .htaccess or PHP files with alternative extensions. An attacker uploads a crafted H5P package containing a webshell and .htaccess that enables PHP execution for .txt files, bypassing security control. This issue has been patched in version 1.11.36.•CVE-2026-30875

References

Sources include official advisories and independent security research.