PHP Object Injection Vulnerability in Academy LMS WordPress Plugin

CVE-2025-12099

What is CVE-2025-12099?

The Academy LMS plugin for WordPress, which serves as a comprehensive eLearning solution, contains a vulnerability that allows authenticated attackers with Administrator-level access to exploit a PHP Object Injection flaw. This vulnerability arises from the deserialization of untrusted input within the 'import_all_courses' function and affects all versions up to and including 3.3.8. While there is no inherent impact in the plugin itself, the risk heightens significantly if another plugin or theme with an established PHP Object Injection (POP) chain is present. Should such a chain exist, attackers could potentially delete arbitrary files, access sensitive data, or execute unauthorized code, depending on the installed components.

References