PT-2025-45559 · WordPress · Academy Lms

Michelle Porter · Published 2025-11-08 · Updated 2025-11-13 · CVE-2025-12099

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Academy LMS – WordPress LMS Plugin for Complete eLearning Solution versions prior to 3.3.9

Description The software is susceptible to a PHP Object Injection due to deserialization of untrusted input within the import all courses function. This allows authenticated attackers with Administrator-level access or higher to inject a PHP Object. The impact of this issue is limited unless another plugin or theme containing a PHP Object Payload (POP) chain is installed, which could allow actions such as arbitrary file deletion, sensitive data retrieval, or code execution.

Recommendations Versions prior to 3.3.9 should be updated.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-12099

Affected Products

Academy Lms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-12099 · Security Note
• https://t.me/cveNotify/142206 · Telegram Post
• https://plugins.trac.wordpress.org/browser/academy/trunk/includes/ajax/course.php#L815 · Note
• https://twitter.com/cracbot/status/1988924865517351151 · Twitter Post
• https://t.me/CVEtracker/36860 · Telegram Post
• https://twitter.com/CVEnew/status/1987086499872162167 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1987156359217811700 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/294b2a7c-8b54-4022-a3af-9a3e3d1d4c11?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3390420 · Note