8.8
CVE-2015-10139
- EPSS 44.33%
- Veröffentlicht 19.07.2025 11:23:36
- Zuletzt bearbeitet 16.12.2025 15:49:59
- Quelle security@wordfence.com
- CVE-Watchlists
- Unerledigt
LoginWPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation
The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wp_ajax_import_data' AJAX action. This makes it possible for authenticated attackers to change otherwise restricted settings and potentially create a new accessible admin account.
Mögliche Gegenmaßnahme
WPLMS Learning Management System for WordPress, WordPress LMS: Update to version 1.9, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Theme
≫
Produkt
WPLMS Learning Management System for WordPress, WordPress LMS
Version
*-1.8.4.1
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Vibethemes ≫ Wordpress Learning Management System SwPlatformwordpress Version >= 1.5.2 < 1.8.9
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 44.33% | 0.974 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security@wordfence.com | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
CWE-269 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.