CVE-2025-14156
Published: 15 December 2025
Description
The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via…
more
the `/fox-lms/v1/payments/create-order` REST API endpoint. This makes it possible for unauthenticated attackers to create new user accounts with arbitrary roles, including administrator, leading to complete site compromise.
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the improper input validation of the 'role' parameter in the /fox-lms/v1/payments/create-order REST API endpoint, preventing unauthenticated creation of administrator accounts.
Enforces logical access authorizations to block unauthenticated privilege escalation via arbitrary role assignment during user creation.
Mandates timely flaw remediation by updating the Fox LMS plugin to version 1.0.5.2 or later, which patches the validation vulnerability.
Security SummaryAI
CVE-2025-14156 is a privilege escalation vulnerability affecting the Fox LMS – WordPress LMS Plugin for WordPress in all versions up to and including 1.0.5.1. The issue stems from improper validation of the 'role' parameter during user creation via the /fox-lms/v1/payments/create-order REST API endpoint, classified under CWE-20 (Improper Input Validation). It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By sending a crafted request to the vulnerable endpoint, they can create new WordPress user accounts assigned arbitrary roles, such as administrator, granting full control over the site and enabling complete compromise.
Advisories reference a code changeset in the plugin's Payments.php file between versions 1.0.5.0 and 1.0.5.2, suggesting validation fixes were introduced in 1.0.5.2. The Wordfence threat intelligence page provides further details on the vulnerability (ID: de4f8d45-9522-4a32-bc98-be8dbf3a5cf1). Security practitioners should update to Fox LMS version 1.0.5.2 or later and review access to the REST API endpoint.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote exploitation of a public-facing WordPress REST API (T1190) to create arbitrary user accounts with administrator roles (T1136.001), granting full site control.