CVE-2025-15521

Name of the Vulnerable Software and Affected Versions Academy LMS – WordPress LMS Plugin for Complete eLearning Solution versions prior to 3.5.1

Description The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution is susceptible to privilege escalation through account takeover. The issue stems from insufficient validation of a user’s identity before allowing password updates, relying solely on a publicly accessible nonce for authorization. This allows unauthenticated attackers to modify any user’s password, including administrator accounts, and gain unauthorized access.

Recommendations Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to version 3.5.1 or later.