PT-2025-51229 · WordPress · Fox Lms

Kenneth Dunn · Published 2025-12-15 · Updated 2025-12-20 · CVE-2025-14156

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fox LMS – WordPress LMS Plugin versions prior to 1.0.5.1

Description The Fox LMS – WordPress LMS Plugin does not properly validate the role parameter when creating new users via the /fox-lms/v1/payments/create-order API endpoint. This allows unauthenticated attackers to create new user accounts with arbitrary roles, including administrator, potentially leading to complete site compromise.

Recommendations Versions prior to 1.0.5.1 should be updated to version 1.0.5.1 or later.

Fix

LPE

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-14156

Affected Products

Fox Lms

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-14156 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/de4f8d45-9522-4a32-bc98-be8dbf3a5cf1?source=cve · Note
• https://twitter.com/CVEnew/status/2000611201055850675 · Twitter Post
• https://twitter.com/Nxploited/status/2002474854172537241 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2001970780071202955 · Twitter Post
• https://twitter.com/0dayPublishing/status/2000580475732078629 · Twitter Post
• https://twitter.com/TheHackerWire/status/2000597642813051023 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?old_path=%2Ffox-lms%2Ftags%2F1.0.5.0%2Fincludes%2Frest%2FPayments.php&new_path=%2Ffox-lms%2Ftags%2F1.0.5.2%2Fincludes%2Frest%2FPayments.php · Note
• https://twitter.com/CveFindCom/status/2000591478100299921 · Twitter Post
• https://t.me/CVEtracker/39838 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2000610115276177734 · Twitter Post