CVE-2025-15521

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15521", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-14T15:32:20.670Z", "datePublished": "2026-01-21T01:23:31.967Z", "dateUpdated": "2026-04-08T16:58:00.512Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:00.512Z"}, "affected": [{"vendor": "kodezen", "product": "Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.5.0. This is due to the plugin not properly validating a user's identity prior to updating their password and relying solely on a publicly-exposed nonce for authorization. This makes it possible for unauthenticated attackers to change arbitrary user's password, including administrators, and gain access to their account."}], "title": "Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6687ebbe-fdf4-4ecb-bf59-034bb4b0104c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/academy/tags/3.5.0/includes/functions.php#L1581"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "vgo0"}], "timeline": [{"time": "2025-12-31T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-14T15:47:53.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-20T11:36:57.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-21T15:30:56.215183Z", "id": "CVE-2025-15521", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T15:43:35.602Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15521", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-21T15:30:56.215183Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T15:31:49.310Z"}}], "cna": {"title": "Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover", "credits": [{"lang": "en", "type": "finder", "value": "vgo0"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "kodezen", "product": "Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.5.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-31T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-14T15:47:53.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-20T11:36:57.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6687ebbe-fdf4-4ecb-bf59-034bb4b0104c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/academy/tags/3.5.0/includes/functions.php#L1581"}], "descriptions": [{"lang": "en", "value": "The Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.5.0. This is due to the plugin not properly validating a user's identity prior to updating their password and relying solely on a publicly-exposed nonce for authorization. This makes it possible for unauthenticated attackers to change arbitrary user's password, including administrators, and gain access to their account."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:00.512Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15521", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:58:00.512Z", "dateReserved": "2026-01-14T15:32:20.670Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-21T01:23:31.967Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution", "vendor": "kodezen", "versions": [{"lessThanOrEqual": "3.5.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.5.0. This is due to the plugin not properly validating a user's identity prior to updating their password and relying solely on a publicly-exposed nonce for authorization. This makes it possible for unauthenticated attackers to change arbitrary user's password, including administrators, and gain access to their account."}, {"lang": "es", "value": "El plugin The Academy LMS \u2013 WordPress LMS Plugin para Complete eLearning Solution para WordPress es vulnerable a escalada de privilegios a trav\u00e9s de la toma de control de cuentas en todas las versiones hasta la 3.5.0, inclusive. Esto se debe a que el plugin no valida correctamente la identidad de un usuario antes de actualizar su contrase\u00f1a y se basa \u00fanicamente en un nonce expuesto p\u00fablicamente para la autorizaci\u00f3n. Esto hace posible que atacantes no autenticados cambien la contrase\u00f1a de cualquier usuario, incluidos los administradores, y obtengan acceso a su cuenta."}], "id": "CVE-2025-15521", "lastModified": "2026-06-17T08:37:56.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15521", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-21T15:30:56.215183Z", "version": "2.0.3"}}]}, "published": "2026-01-21T02:15:48.363", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/academy/tags/3.5.0/includes/functions.php#L1581"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6687ebbe-fdf4-4ecb-bf59-034bb4b0104c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T23:54:47.101566+00:00", "value": {"mitigation_remediation": ["Upgrade the Academy LMS plugin to the latest release that contains proper authentication checks before allowing a password change. ", "If an update cannot be performed immediately, restrict access to the password\u2011update endpoint so that only authenticated administrators can send requests, for example by adding role\u2011based access controls or CSRF protections. ", "Monitor system logs for unusual password change events and enforce multi\u2011factor authentication for all administrator accounts to reduce the impact of any future credential compromise."], "summary": {"action": "Patch Immediately", "impact": "Privilege Escalation via Account Takeover"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all releases of the Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution up to and including version 3.5.0 distributed by kodezen. Any WordPress site currently running one of these versions is susceptible.", "description_and_impact": "The Academy LMS plugin for WordPress is vulnerable because it fails to verify the identity of a user before allowing a password change, relying only on a publicly exposed nonce. The flaw is a CWE\u2011639 authorization bypass vulnerability. This flaw lets an attacker set any user\u2019s password without authentication, enabling administrators and other privileged accounts to be hijacked. The weakness directly compromises both confidentiality and integrity of user accounts and can lead to full system compromise if an attacker gains access to an administrator profile.", "risk_and_exploitability": "With a CVSS score of 9.8 the issue is considered critical. The EPSS score of less than 1% indicates that exploitation is unlikely but not impossible, and the weakness is not currently listed in the CISA KEV catalog. The likely attack path involves sending an unauthenticated HTTP request to the password\u2011reset endpoint, where the plugin accepts the nonce and changes the target user\u2019s password. Once access is gained, further privilege escalation or data exfiltration may follow."}}}}, "created": "2026-01-21T11:18:36.476825+00:00", "updated": "2026-04-22T00:00:03.950104+00:00", "vendors": ["kodezen", "kodezen$PRODUCT$academy_lms", "wordpress", "wordpress$PRODUCT$wordpress"]}