Privilege escalation in Academylms Academy Lms Pro
CVE-2025-11086
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.7. This is due to the plugin not properly validating a user's role prior to registering a user via the Social Login addon. This makes it possible for unauthenticated attackers to update their role to Administrator when registering on the site.
Vulnerability class: Privilege Escalation
EPSS: 0.004 (30.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Academylms Academy Lms Pro — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-11086?
- CVE-2025-11086 is a high-severity vulnerability in Academylms Academy Lms Pro, classified under Improper Privilege Management. CVSS score: 8.1/10. Published 2025-10-22.
- How severe is CVE-2025-11086?
- High severity. CVSS v3 base score is 8.1 out of 10.