PT-2025-48771 · WordPress · Designthemes Lms+1

Ismail Syaleh · Published 2025-12-02 · Updated 2025-12-03 · CVE-2025-13542

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DesignThemes LMS plugin for WordPress versions up to and including 1.0.4

Description The DesignThemes LMS plugin for WordPress is susceptible to a privilege escalation issue. The dtlms register user front end function does not adequately restrict the user roles that can be assigned during registration. This allows unauthenticated attackers to register with the 'administrator' role, thereby gaining administrative access to the WordPress site.

Recommendations Versions prior to 1.0.4 should be updated to address this issue.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-13542

Affected Products

Designthemes Lms

Wordpress

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13542 · Security Note
• https://twitter.com/VulmonFeeds/status/1996113915764257150 · Twitter Post
• https://twitter.com/CVEnew/status/1995939513453985943 · Twitter Post
• https://twitter.com/CveFindCom/status/1995955948632899654 · Twitter Post
• https://t.me/CVEtracker/38715 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c880470f-3f81-47a2-b450-7074410e9f43?source=cve · Note
• https://twitter.com/0dayPublishing/status/1995941087651717181 · Twitter Post
• https://themeforest.net/item/egrad-education-wordpress-theme/42803015 · Note