Sensitive Information Exposure in Academy LMS WordPress Plugin

CVE-2025-12098

What is CVE-2025-12098?

The Academy LMS plugin for WordPress is affected by a security flaw that allows unauthenticated attackers to access sensitive information, particularly the Facebook App Secret, when the Facebook Social Login feature is activated. This exposure occurs specifically through the 'enqueue_social_login_script' function, putting user data at risk for all versions up to and including 3.3.8. Website administrators are urged to update to newer versions to mitigate this vulnerability.

References