What is the CVSS score of CVE-2026-12153?

CVE-2026-12153 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WP Learn Manager are affected by CVE-2026-12153?

A critical vulnerability in the WP Learn Manager WordPress plugin (CVE-2026-12153, CVSS 9.8) allows external attackers to gain unrestricted administrative access to any WordPress site running this…

How to fix or mitigate CVE-2026-12153?

Within 24 hours: Identify all WordPress instances running WP Learn Manager versions ≤1.1.8 and immediately deactivate the plugin. Within 7 days: Monitor the plugin repository and Wordfence advisories for vendor patch release announcements. Within 30 days: Apply the vendor-released patch when available, or migrate affected WordPress sites to an alternative learning management plugin.

WP Learn Manager CVE-2026-12153

EUVD-2026-42172 CRITICAL

Missing Authorization (CWE-862)

2026-07-08 Wordfence

GHSA-hpq8-57wr-526c

WordPress Authentication Bypass Wordpress Plugin Wp Learn Manager

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated, network, no-interaction install/activate of arbitrary plugins yields administrator-equivalent control, so PR:N/UI:N with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 06:29 vuln.today

CVE Published

Jul 08, 2026 - 05:34 nvd

CRITICAL 9.8

DescriptionCVE.org

The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins from the WordPress.org repository on the vulnerable site.

Articles & Coverage 1

News Critical Authorization Bypass in WP Learn Manager WordPress Plugin - CVE-2026-12153 Jul 09, 2026

AnalysisAI

Authorization bypass in the WP Learn Manager WordPress plugin (all versions through 1.1.8) lets unauthenticated attackers install and activate arbitrary plugins from the WordPress.org repository on a vulnerable site. The flaw stems from AJAX handlers that fail to verify a caller's authorization, and Wordfence rates it CVSS 9.8. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity nature makes it a high-priority patch target.

Technical ContextAI

The vulnerable code lives in the plugin's AJAX layer (includes/ajax.php) and its jslearnmanager model (modules/jslearnmanager/model.php), where actions that install and activate WordPress.org plugins are exposed without a proper capability check (e.g. current_user_can) or nonce verification tied to an authorized role. This is a classic CWE-862 (Missing Authorization) defect: the application performs a privileged administrative operation on behalf of any requester because it never confirms the requester is entitled to perform it. Because installed plugins run with full site privileges, abusing a plugin-install primitive effectively hands an attacker administrator-equivalent control of the WordPress instance.

RemediationAI

No vendor-released patch identified at time of analysis - every version through 1.1.8 is affected and no fixed version is stated in the available data, so the primary compensating control is to deactivate and remove the WP Learn Manager plugin until the vendor publishes a fixed release above 1.1.8, tracked via the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/8cbf5121-2511-4e21-a346-67fa1e34fc02?source=cve). If the plugin cannot be removed for business reasons, restrict access to WordPress admin-ajax.php via a web application firewall or virtual patch that blocks unauthenticated requests to the plugin's install/activate AJAX actions, and audit the site's installed and active plugin list for any unexpected additions as a compromise indicator; note that broad admin-ajax filtering can break legitimate front-end AJAX for other plugins, so scope rules to the specific action names where possible.