Privilege Escalation Vulnerability in Fox LMS Plugin for WordPress

CVE-2025-14156

What is CVE-2025-14156?

The Fox LMS Plugin for WordPress is susceptible to a serious privilege escalation issue in all versions up to and including 1.0.5.1. This vulnerability arises from inadequate validation of the 'role' parameter when creating new user accounts through the REST API endpoint /fox-lms/v1/payments/create-order. Due to this flaw, unauthenticated attackers can exploit the system to create user accounts with arbitrary roles, potentially granting themselves administrator privileges and compromising the entire site.

References