PT-2025-45558 · Facebook+1 · Facebook+1

Michelle Porter · CVE-2025-12098 · Published 2025-11-08 · Updated 2025-11-08

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Academy LMS – WordPress LMS Plugin for Complete eLearning Solution versions prior to 3.3.9

Description The Academy LMS – WordPress LMS Plugin for WordPress is susceptible to sensitive information disclosure. Specifically, the enqueue social login script function can allow unauthenticated attackers to extract sensitive data, including the Facebook App Secret, if Facebook Social Login is enabled.

Recommendations Update to version 3.3.9 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-12098

Affected Products

Academy Lms

Facebook

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12098 · Security Note
• https://t.me/cveNotify/142205 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1987158919047717177 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f70ee339-d9d4-43ad-8605-6a5533783718?source=cve · Note
• https://academylms.net/whats-new · Note
• https://twitter.com/CVEnew/status/1987086498882290146 · Twitter Post
• https://t.me/CVEtracker/36859 · Telegram Post