What is CVE-2025-2290?

CVE-2025-2290 is a medium-severity vulnerability in Chrisbadgett Lifterlms – Wp Lms For Elearning, Online Courses, & Quizzes, classified under Missing Authorization. CVSS score: 5.3/10. Published 2025-03-19.

How severe is CVE-2025-2290?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Auth bypass in Chrisbadgett Lifterlms – Wp Lms For Elearning, Online Courses, & Quizzes

CVE-2025-2290

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to "Trash" for every published post, therefore limiting the availability of the website's content.

Vulnerability class: Broken Access Control

EPSS: 0.003 (20.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Chrisbadgett Lifterlms – Wp Lms For Elearning, Online Courses, & Quizzes — versions 0
Lifterlms

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

security@wordfence.com (Third Party Advisory)
security@wordfence.com (Patch)

Frequently asked questions

What is CVE-2025-2290?: CVE-2025-2290 is a medium-severity vulnerability in Chrisbadgett Lifterlms – Wp Lms For Elearning, Online Courses, & Quizzes, classified under Missing Authorization. CVSS score: 5.3/10. Published 2025-03-19.
How severe is CVE-2025-2290?: Medium severity. CVSS v3 base score is 5.3 out of 10.