CVE-2025-14156
📋 TL;DR
This vulnerability allows unauthenticated attackers to create new user accounts with administrator privileges in WordPress sites using the Fox LMS plugin. Attackers can completely compromise affected websites by gaining full administrative control. All WordPress installations with Fox LMS plugin versions up to 1.0.5.1 are affected.
💻 Affected Systems
- Fox LMS – WordPress LMS Plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete site takeover with administrative access, data theft, malware injection, defacement, and use as attack platform.
Likely Case
Administrator account creation leading to site compromise, data exfiltration, and backdoor installation.
If Mitigated
Limited impact if proper network segmentation, WAF rules, and monitoring are in place to detect suspicious user creation.
🎯 Exploit Status
The vulnerability is straightforward to exploit via HTTP POST requests to the vulnerable endpoint with crafted parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.5.2
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Fox LMS plugin. 4. Click 'Update Now' if update available. 5. If no update shows, manually download version 1.0.5.2 from WordPress.org and replace plugin files.
🔧 Temporary Workarounds
Block Vulnerable REST Endpoint
linuxAdd .htaccess rule to block access to the vulnerable endpoint
# Add to .htaccess in WordPress root directory
RewriteEngine On
RewriteRule ^wp-json/fox-lms/v1/payments/create-order - [F,L]
Disable Plugin
allTemporarily disable Fox LMS plugin until patched
wp plugin deactivate fox-lms
🧯 If You Can't Patch
- Disable the Fox LMS plugin immediately
- Implement WAF rules to block requests to /wp-json/fox-lms/v1/payments/create-order
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Fox LMS version. If version is 1.0.5.1 or lower, you are vulnerable.Check Version:
wp plugin list --name=fox-lms --field=versionVerify Fix Applied:
After updating, verify Fox LMS plugin shows version 1.0.5.2 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-json/fox-lms/v1/payments/create-order with role parameter
- Unexpected user creation events, especially with administrator role
- Multiple failed login attempts followed by successful admin login from new IP
Network Indicators:
- HTTP POST requests to vulnerable endpoint from unusual IPs
- Traffic patterns showing user creation via REST API
SIEM Query:
source="web_logs" AND (url="/wp-json/fox-lms/v1/payments/create-order" OR (event="user_created" AND role="administrator" AND source="rest_api"))