CVE-2015-10139

Description

The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wp_ajax_import_data' AJAX action. This makes it possible for authenticated attackers to change otherwise restricted settings and potentially create a new accessible admin account.

PUBLISHED Reserved 2025-07-18 | Published 2025-07-19 | Updated 2026-04-08 | Assigner Wordfence

Problem types

CWE-269 Improper Privilege Management

Product status

Timeline

Credits

Evex finder

References

www.wordfence.com/...-8216-4276-a810-860f9b52c447?source=cve

packetstormsecurity.com/files/130291/

www.rapid7.com/.../admin/http/wp_wplms_privilege_escalation/

twitter.com/_wpscan_/status/564874637679820800?lang=ca

wpscan.com/vulnerability/7785

themeforest.net/.../wplms-learning-management-system/6780226

cve.org (CVE-2015-10139)

nvd.nist.gov (CVE-2015-10139)

Download JSON