PT-2025-30133 · WordPress · Wplms

Published 2025-07-19 · Updated 2025-12-16 · CVE-2015-10139

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPLMS versions 1.5.2 through 1.8.4.1

Description The WPLMS theme for WordPress is susceptible to privilege escalation via the wp ajax import data API endpoint. Authenticated attackers can modify restricted settings and potentially create a new accessible admin account.

Recommendations Update WPLMS to a version later than 1.8.4.1.

Exploit

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2015-10139

Affected Products

Wplms

References · 10

• 🔥 https://packetstormsecurity.com/files/130291 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-10139 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6e0e8f5f-8216-4276-a810-860f9b52c447?source=cve · Note
• https://t.me/cveNotify/145960 · Telegram Post
• https://themeforest.net/item/wplms-learning-management-system/6780226 · Note
• https://wpscan.com/vulnerability/7785 · Note
• https://t.me/cvetracker/28209 · Telegram Post
• https://t.me/cvenotify/129546 · Telegram Post
• https://twitter.com/_wpscan_/status/564874637679820800?lang=ca · Note
• https://rapid7.com/db/modules/auxiliary/admin/http/wp_wplms_privilege_escalation · Note