CVE-2025-14156

The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via the `/fox-lms/v1/payments/create-order` REST API endpoint. This makes it possible for unauthenticated attackers to create new user accounts with arbitrary roles, including administrator, leading to complete site compromise.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/changeset?old_path=%2Ffox-lms%2Ftags%2F1.0.5.0%2Fincludes%2Frest%2FPayments.php&new_path=%2Ffox-lms%2Ftags%2F1.0.5.2%2Fincludes%2Frest%2FPayments.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/de4f8d45-9522-4a32-bc98-be8dbf3a5cf1?source=cve

Configurations

No configuration.

History

07 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El plugin Fox LMS - WordPress LMS Plugin para WordPress es vulnerable a escalada de privilegios en todas las versiones hasta la 1.0.5.1, inclusive. Esto se debe a que el plugin no valida correctamente el parámetro 'role' al crear nuevos usuarios a través del endpoint de la API REST '/fox-lms/v1/payments/create-order'. Esto permite que atacantes no autenticados creen nuevas cuentas de usuario con roles arbitrarios, incluido el de administrador, lo que lleva a un compromiso completo del sitio.

Information

Published : 2025-12-15 15:15

Updated : 2026-10-07 19:10

NVD link : CVE-2025-14156

Mitre link : CVE-2025-14156

CVE.ORG link : CVE-2025-14156

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-14156", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14156", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-15T14:49:53.846684Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "ays-pro", "product": "Fox LMS \u2013 WordPress LMS Plugin", "versions": [{"status": "affected", "version": "1.0.4.7", "versionType": "semver", "lessThanOrEqual": "1.0.5.1"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-15T15:15:49.173", "references": [{"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Ffox-lms%2Ftags%2F1.0.5.0%2Fincludes%2Frest%2FPayments.php&new_path=%2Ffox-lms%2Ftags%2F1.0.5.2%2Fincludes%2Frest%2FPayments.php", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/de4f8d45-9522-4a32-bc98-be8dbf3a5cf1?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The Fox LMS \u2013 WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via the `/fox-lms/v1/payments/create-order` REST API endpoint. This makes it possible for unauthenticated attackers to create new user accounts with arbitrary roles, including administrator, leading to complete site compromise."}, {"lang": "es", "value": "El plugin Fox LMS - WordPress LMS Plugin para WordPress es vulnerable a escalada de privilegios en todas las versiones hasta la 1.0.5.1, inclusive. Esto se debe a que el plugin no valida correctamente el par\u00e1metro 'role' al crear nuevos usuarios a trav\u00e9s del endpoint de la API REST '/fox-lms/v1/payments/create-order'. Esto permite que atacantes no autenticados creen nuevas cuentas de usuario con roles arbitrarios, incluido el de administrador, lo que lleva a un compromiso completo del sitio."}], "lastModified": "2026-10-07T19:10:00.160", "sourceIdentifier": "security@wordfence.com"}