CVE-2025-14156: 
WordPress vulnerability analysis and mitigation

CVE-2025-14156 is a critical privilege escalation vulnerability in the Fox LMS – WordPress LMS Plugin for WordPress, affecting all versions up to and including 1.0.5.1. The flaw allows unauthenticated attackers to create new user accounts with arbitrary roles — including administrator — by exploiting improper validation of the role parameter in the plugin's REST API endpoint. It was disclosed on December 15, 2025, with the CVE assigned by Wordfence. It carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, Red Hat CVE).

The root cause is improper input validation (CWE-20) in the /fox-lms/v1/payments/create-order REST API endpoint, which fails to restrict or sanitize the role parameter during user creation. Because the endpoint is accessible without authentication and does not enforce role allowlisting, an attacker can supply any WordPress role value — including administrator — in the request body. The fix is visible in the plugin's changeset, where the Payments.php file was updated between versions 1.0.5.0 and 1.0.5.2 to properly validate the role parameter (WordPress Trac). A public proof-of-concept exploit is available on GitHub (PoC GitHub).

Successful exploitation grants an unauthenticated attacker full administrative access to the WordPress site, enabling complete site compromise. An attacker with administrator privileges can install malicious plugins or themes, modify site content, access sensitive user data, exfiltrate credentials, and establish persistent backdoors. The impact spans all three security dimensions — confidentiality, integrity, and availability — at a high level, with potential for lateral movement within the hosting environment (Wordfence, Red Hat CVE).

A public proof-of-concept exploit was published on GitHub (https://github.com/Nxploited/CVE-2025-14156) on March 2, 2026, and has been indexed by Vulners (PoC GitHub). The vulnerability requires no authentication, no user interaction, and no special preconditions, making it trivially exploitable over the network. The EPSS score is approximately 0.133%, and there is no current evidence of active in-the-wild exploitation or CISA KEV catalog listing. Qualys has published a detection (ID: 530758) for this vulnerability (Qualys).

1. Reconnaissance: Identify WordPress sites running the Fox LMS plugin (versions ≤ 1.0.5.1) using tools like WPScan, Shodan, or Google dorks (e.g., inurl:/fox-lms/).
2. Confirm endpoint availability: Send a GET or OPTIONS request to /wp-json/fox-lms/v1/payments/create-order to verify the REST API endpoint is accessible without authentication.
3. Craft malicious POST request: Send a POST request to /wp-json/fox-lms/v1/payments/create-order with a JSON body specifying a new user's credentials and setting the role parameter to administrator (e.g., {"username": "attacker", "email": "attacker@evil.com", "password": "P@ssw0rd!", "role": "administrator"}).
4. Verify account creation: Confirm the new administrator account was created by attempting to log in at /wp-admin with the supplied credentials.
5. Achieve full site compromise: Use the newly created administrator account to install a malicious plugin, upload a web shell, exfiltrate data, or establish persistent backdoor access (PoC GitHub, Wordfence).

• Network: Unexpected POST requests to /wp-json/fox-lms/v1/payments/create-order from unknown or external IP addresses, especially with JSON bodies containing a role field set to administrator.
• Logs: WordPress access logs showing POST requests to the Fox LMS payment REST API endpoint from unauthenticated sources; WordPress authentication logs showing new administrator account logins shortly after the API call.
• File System: Newly installed plugins or themes not authorized by site administrators; presence of web shells or backdoor scripts in the WordPress uploads or plugins directories.
• WordPress Database: New entries in the wp_users and wp_usermeta tables with wp_capabilities set to administrator for accounts not created through normal registration flows.
• Process: Unusual PHP processes spawning shell commands or making outbound network connections from the web server process.

The vendor has released a patched version: Fox LMS – WordPress LMS Plugin 1.0.5.2, which properly validates the role parameter in the Payments.php file (WordPress Trac). Site administrators should immediately upgrade to version 1.0.5.2 or later. If immediate patching is not feasible, consider temporarily deactivating the Fox LMS plugin or using a WAF rule to block unauthenticated POST requests to the /fox-lms/v1/payments/create-order endpoint. Additionally, audit existing WordPress user accounts for unauthorized administrator accounts and remove any that were not legitimately created (Wordfence).

Wordfence, which discovered and reported the vulnerability, published it to their threat intelligence platform on December 15, 2025, and included it in their weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026 (Wordfence Weekly Report). CISA included the CVE in their vulnerability bulletin for the week of December 15, 2025 (CISA Bulletin). Check Point also published an advisory (CPAI-2025-12527) referencing this vulnerability (Check Point Advisory).