Introduction
Attackers can gain full administrative access to WordPress sites running Academy LMS by exploiting a flaw in the Social Login addon. The flaw affects a large number of eLearning platforms and course providers that rely on Academy LMS for user management and course delivery.
Academy LMS, developed by Creativeitem, is one of the major Learning Management System plugins for WordPress. Thousands of educational institutions and online course creators use it to build, manage, and sell eLearning content. It integrates with WooCommerce, payment gateways, and various add-ons.
Technical information
CVE-2025-11086 is a privilege escalation vulnerability in the Social Login addon of the Academy LMS WordPress plugin. The plugin does not properly validate user roles when someone registers through social authentication (Facebook or Google).
Vulnerability mechanism:
- When a new user registers through the Social Login addon, the plugin processes the profile data returned by the social provider.
- In all versions up to and including 3.3.7, the plugin does not enforce strict role assignment, and it does not sanitize or validate the user-supplied parameters that set the assigned role.
- An attacker can manipulate the registration request, for example by intercepting and modifying HTTP parameters, to specify a privileged role such as 'Administrator'.
- The plugin then creates the new account with administrative privileges, which gives the attacker full access to the WordPress site.
Root cause:
- Insufficient validation of user role assignment during social login registration (CWE-269: Improper Privilege Management).
- The vulnerable code path runs while the plugin processes OAuth callbacks from Facebook or Google and maps the returned profile data to WordPress user accounts.
- No code snippets are publicly available, but the flaw is confirmed in the plugin's handling of registration data.
Exploit characteristics:
- No prior authentication is required. Any unauthenticated user can perform the attack.
- Attack complexity is low. The attacker only needs to manipulate the registration process.
- A site is vulnerable only when the Social Login addon is enabled and configured.
Affected systems and versions
- Product: Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
- Affected versions: All versions up to and including 3.3.7
- Vulnerable configuration: Sites with the Social Login addon enabled (Facebook or Google social authentication)
Vendor security history
Creativeitem, the developer of Academy LMS, has a documented history of privilege escalation vulnerabilities:
- CVE-2024-1505: Privilege escalation via improper user meta updates (patched in version 1.9.20)
- CVE-2025-56747: Privilege escalation in API instructor controller (affecting versions up to 5.13)
The vendor has patched quickly in the past, taking four days for CVE-2024-1505. The repeat of similar issues, though, suggests ongoing weaknesses in access control validation and privilege management in the codebase.
