Get real-time updates on Telegram
CVE-2025-12099: Academy LMS – WordPress LMS Plugin for Complete eLearning Solution 0 through 3.3.8
CVE-2025-12099. CVSS 3.1 base score 7.2 (HIGH, Vendor/CNA). EPSS 0.00519 (percentile 0.42149), scored 2026-10-06.
Affected technology
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution · 0 through 3.3.8
kodezen
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · No user interaction required
What an attacker can do
The source says if a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Vendor/CNA’s CVSS 3.1 assessment (base score 7.2/10) rates confidentiality, integrity and availability impact as high.
- CWE
- CWE-502
- CCR priority
- 28.9 /100 (P4)
- CVSS 3.1
- 7.2 /10 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · Vendor/CNA
- EPSS
- 0.00519 · percentile 0.42149 · 2026-10-06
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-07 23:02:50.240617+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2025-12099.html