Privilege Escalation Vulnerability in Academy LMS Plugin for WordPress

CVE-2025-15521

What is CVE-2025-15521?

The Academy LMS plugin for WordPress is susceptible to a privilege escalation vulnerability which allows unauthorized users to change passwords of other accounts, including those belonging to administrators. This issue arises from inadequate user identity validation during password updates, as the plugin solely depends on a publicly available nonce for authorization. Consequently, attackers can exploit this flaw to gain access to user accounts without proper authentication, fundamentally compromising account security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References