CVE-2025-12099

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12099", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-22T22:01:34.655Z", "datePublished": "2025-11-08T08:27:41.410Z", "dateUpdated": "2026-04-08T16:43:18.108Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:18.108Z"}, "affected": [{"vendor": "kodezen", "product": "Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.8 via deserialization of untrusted input in the 'import_all_courses' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present."}], "title": "Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/294b2a7c-8b54-4022-a3af-9a3e3d1d4c11?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/academy/trunk/includes/ajax/course.php#L815"}, {"url": "https://plugins.trac.wordpress.org/changeset/3390420/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-502 Deserialization of Untrusted Data", "cweId": "CWE-502", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Michelle Porter"}], "timeline": [{"time": "2025-10-22T22:24:18.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-07T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-10T14:08:06.829468Z", "id": "CVE-2025-12099", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T14:14:21.468Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12099", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-10T14:08:06.829468Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T14:08:07.583Z"}}], "cna": {"title": "Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'", "credits": [{"lang": "en", "type": "finder", "value": "Michelle Porter"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "academylms", "product": "Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.3.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-22T22:24:18.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-07T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/294b2a7c-8b54-4022-a3af-9a3e3d1d4c11?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/academy/trunk/includes/ajax/course.php#L815"}, {"url": "https://plugins.trac.wordpress.org/changeset/3390420/"}], "descriptions": [{"lang": "en", "value": "The Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.8 via deserialization of untrusted input in the 'import_all_courses' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-08T08:27:41.410Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12099", "state": "PUBLISHED", "dateUpdated": "2025-11-10T14:14:21.468Z", "dateReserved": "2025-10-22T22:01:34.655Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-08T08:27:41.410Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution", "vendor": "kodezen", "versions": [{"lessThanOrEqual": "3.3.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.8 via deserialization of untrusted input in the 'import_all_courses' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present."}, {"lang": "es", "value": "El plugin The Academy LMS - WordPress LMS Plugin for Complete eLearning Solution para WordPress es vulnerable a Inyecci\u00f3n de Objetos PHP en todas las versiones hasta, e incluyendo, la 3.3.8 a trav\u00e9s de la deserializaci\u00f3n de entrada no confiable en la funci\u00f3n 'import_all_courses'. Esto hace posible que atacantes autenticados, con acceso de nivel de Administrador y superior, inyecten un Objeto PHP. No hay una cadena POP conocida presente en el software vulnerable, lo que significa que esta vulnerabilidad no tiene impacto a menos que otro plugin o tema que contenga una cadena POP est\u00e9 instalado en el sitio. Si una cadena POP est\u00e1 presente a trav\u00e9s de un plugin o tema adicional instalado en el sistema objetivo, puede permitir al atacante realizar acciones como eliminar archivos arbitrarios, recuperar datos sensibles o ejecutar c\u00f3digo dependiendo de la cadena POP presente."}], "id": "CVE-2025-12099", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12099", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-10T14:08:06.829468Z", "version": "2.0.3"}}]}, "published": "2025-11-08T09:15:34.050", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/academy/trunk/includes/ajax/course.php#L815"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3390420/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/294b2a7c-8b54-4022-a3af-9a3e3d1d4c11?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T21:17:00.339452+00:00", "value": {"mitigation_remediation": ["Update the Academy LMS plugin to a version newer than 3.3.8 or apply the vendor\u2019s official patch. ", "Disable or restrict the import_all_courses functionality for non\u2011admin users, removing the capability if it is not required. ", "Audit installed plugins and themes for potential POP chains and remove or update any that could provide a vulnerability vector."], "summary": {"action": "Apply Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All installations of the Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution (kodezen) on WordPress sites that are version 3.3.8 or earlier are affected.", "description_and_impact": "The vulnerability is PHP Object Injection through the import_all_courses function, allowing authenticated administrators to create a malicious object during deserialization. Although the injection alone does not execute code, it can be leveraged if a point\u2011of\u2011call (POP) chain exists in another plugin or theme, enabling the attacker to delete files, exfiltrate data or run arbitrary code. The weakness is identified as CWE\u2011502.", "risk_and_exploitability": "The CVSS score of 7.2 indicates high severity when a POP chain is available, but the EPSS score of less than 1% reflects a low current exploitation probability. The vulnerability is not listed in CISA\u2019s KEV catalog. An attacker with administrator access can use the import functionality to inject a crafted object, and if the site also runs a plugin or theme that contains a POP chain, the injection can lead to remote code execution, data loss or file deletion. Sites that do not have such third\u2011party components face limited risk, while those that do should treat this as a material threat."}}}}, "created": "2025-11-10T09:33:24.868687+00:00", "updated": "2026-04-22T21:30:27.813992+00:00", "vendors": ["academylms", "academylms$PRODUCT$academy_lms", "wordpress", "wordpress$PRODUCT$wordpress"]}