Security readout for executives and security teams
Plain-English summary
This vulnerability can let a logged-in user of an affected WPLMS WordPress site gain administrator-level control. For an online learning platform, that could expose student data, course content, payments-related workflows, and site availability.
Executive priority
Treat this as urgent for any internet-facing learning site with user logins. The business risk is full site takeover from an authenticated account, but active exploitation is not confirmed by the provided sources.
Technical view
WPLMS versions 1.5.2 through 1.8.4.1 are reported vulnerable to privilege escalation through the wp_ajax_import_data AJAX action. The issue maps to CWE-269 and has CVSS 8.8 because low-privileged authenticated access can affect confidentiality, integrity, and availability.
Likely exposure
Exposure is most likely on WordPress sites running WPLMS 1.5.2 through 1.8.4.1, especially sites with public student or customer logins. The supplied affected metadata is inconsistent, so confirm exposure by installed product and version, not the CPE field alone.
Exploitation context
Public references include Packet Storm, Rapid7, and WPScan, indicating public exploitation knowledge or tooling exists. The source bundle says KEV is false and provides no cited evidence of active exploitation in the wild.
Researcher notes
The core issue is improper privilege control on an authenticated AJAX import action. Do not rely on the bundle's affected CPE data because it appears incomplete or inconsistent with the narrative version range.
Mitigation direction
- Check current VibeThemes or WPLMS guidance for the fixed version or recommended mitigation.
- Upgrade WPLMS if a supported fixed release is available from the vendor.
- Disable or remove WPLMS on exposed sites if no safe update path exists.
- Restrict creation and use of low-privileged WordPress accounts until remediated.
- Review administrator accounts and security-sensitive settings for unauthorized changes.
Validation and detection
- Inventory WordPress sites using the WPLMS theme or LMS package.
- Confirm whether installed versions fall within 1.5.2 through 1.8.4.1.
- Review WordPress users for unexpected administrator accounts.
- Check audit logs for suspicious settings changes around import-related AJAX activity.
- Verify remediation against vendor guidance after updating or disabling the component.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-269: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2015-10139 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6e0e8f5f-8216-4276-a810-860f9b52c447?source=cveCVE reference
- https://packetstormsecurity.com/files/130291/CVE reference
- https://www.rapid7.com/db/modules/auxiliary/admin/http/wp_wplms_privilege_escalation/CVE reference
- https://twitter.com/_wpscan_/status/564874637679820800?lang=caCVE reference
- https://wpscan.com/vulnerability/7785CVE reference
- https://themeforest.net/item/wplms-learning-management-system/6780226CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Privilege Management
Improper Privilege Management represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.