PT-2026-3751 · WordPress · Academy Lms

Vgo0 · Published 2026-01-21 · Updated 2026-02-28 · CVE-2025-15521

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Academy LMS – WordPress LMS Plugin for Complete eLearning Solution versions prior to 3.5.1

Description The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution is susceptible to privilege escalation through account takeover. The issue stems from insufficient validation of a user’s identity before allowing password updates, relying solely on a publicly accessible nonce for authorization. This allows unauthenticated attackers to modify any user’s password, including administrator accounts, and gain unauthorized access.

Recommendations Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to version 3.5.1 or later.

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-15521

Affected Products

Academy Lms

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-15521 · Security Note
• https://plugins.trac.wordpress.org/browser/academy/tags/3.5.0/includes/functions.php#L1581 · Note
• https://twitter.com/CVEnew/status/2013812114641822150 · Twitter Post
• https://twitter.com/Komodosec/status/2027776460455604550 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2020411277852414313 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6687ebbe-fdf4-4ecb-bf59-034bb4b0104c?source=cve · Note
• https://twitter.com/CveFindCom/status/2013803546081214864 · Twitter Post
• https://t.me/CVEtracker/42647 · Telegram Post
• https://twitter.com/cracbot/status/2015741548860944424 · Twitter Post
• https://t.me/pentestingnews/72534 · Telegram Post
• https://t.me/cveNotify/149365 · Telegram Post
• https://twitter.com/Karma_X_Inc/status/2014238063157793242 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2020918165723546022 · Twitter Post
• https://twitter.com/0dayPublishing/status/2013792709530505346 · Twitter Post