CVE-2024-1505 Overview
CVE-2024-1505 is a privilege escalation vulnerability in the Academy LMS – eLearning and online course solution plugin for WordPress. The flaw affects all versions up to and including 1.9.19. The plugin's saved_user_info() function permits arbitrary user meta updates without validating restricted fields. Authenticated attackers with low-privilege accounts, including students, can escalate their role to administrator. The weakness is tracked under [CWE-269: Improper Privilege Management].
Critical Impact
Any authenticated user of a site running Academy LMS ≤ 1.9.19 can promote themselves to administrator and take full control of the WordPress site.
Affected Products
- Kodezen Academy LMS WordPress plugin, all versions ≤ 1.9.19
- WordPress sites offering enrollment or student self-registration with Academy LMS installed
- Multisite WordPress deployments where Academy LMS is network-activated
Discovery Timeline
- 2024-03-13 - CVE-2024-1505 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1505
Vulnerability Analysis
The Academy LMS plugin exposes a user profile update handler that writes attacker-supplied values directly into WordPress user meta. The saved_user_info() function accepts arbitrary keys and values from the request without an allowlist of editable fields. WordPress stores role and capability data in the wp_capabilities user meta key. Because that key is not filtered by the plugin, an authenticated attacker can submit a crafted profile update that overwrites their own capabilities and assigns the administrator role. The attack requires only a low-privilege authenticated session, such as a student account created through the LMS enrollment workflow.
Root Cause
The root cause is missing authorization and input filtering in saved_user_info(). The function trusts caller-controlled meta keys and does not restrict updates to a fixed set of profile fields. It also lacks a capability check to prevent low-privilege users from modifying role-defining meta such as wp_capabilities and wp_user_level.
Attack Vector
Exploitation is performed over the network by an authenticated user. The attacker submits a request to the plugin's user information save endpoint and includes an additional meta parameter that maps to wp_capabilities. The plugin writes the value directly, promoting the caller to administrator on the next authorization check. No user interaction from an existing administrator is required. Verified technical detail is documented in the Wordfence Vulnerability Report and the fix is visible in the WordPress Changeset Update.
Detection Methods for CVE-2024-1505
Indicators of Compromise
- New administrator accounts that were previously registered as students or subscribers in wp_users and wp_usermeta.
- Recent modifications to the wp_capabilities meta key for accounts that did not previously hold elevated roles.
- POST requests to Academy LMS user profile endpoints containing unexpected meta keys such as wp_capabilities or wp_user_level.
- Installation of unfamiliar plugins, themes, or admin users shortly after an LMS profile update event.
Detection Strategies
- Audit the wp_usermeta table for role changes, comparing account creation role with the current wp_capabilities value.
- Alert on WordPress set_user_role and updated_user_meta hooks for the wp_capabilities key when triggered by non-administrator sessions.
- Inspect web server logs for POSTs to admin-ajax.php or Academy LMS routes that carry meta_key=wp_capabilities in the payload.
Monitoring Recommendations
- Enable WordPress activity logging for role assignment, user creation, and plugin or theme installation events.
- Forward WordPress audit logs and web server logs to a centralized SIEM for correlation with authentication events.
- Track the running version of Academy LMS across all sites and alert on any host still exposing ≤ 1.9.19.
How to Mitigate CVE-2024-1505
Immediate Actions Required
- Update Academy LMS to a version later than 1.9.19 on every affected WordPress site.
- Review all administrator accounts and remove any that cannot be tied to a legitimate user.
- Reset passwords and revoke active sessions for all users after confirming the plugin is patched.
- Rotate WordPress secret keys in wp-config.php if unauthorized administrator activity is suspected.
Patch Information
The vendor fix is published as part of the plugin update referenced in the WordPress Changeset Update. The patch restricts which user meta keys saved_user_info() will write and prevents role-defining fields such as wp_capabilities from being modified through the profile endpoint. Site administrators should upgrade through the WordPress plugin manager or via WP-CLI and confirm the installed version is greater than 1.9.19.
Workarounds
- Disable open student self-registration until the plugin is updated to reduce the pool of accounts that can trigger the flaw.
- Deactivate the Academy LMS plugin on sites that cannot be patched immediately.
- Apply a Web Application Firewall rule that blocks requests to Academy LMS profile endpoints containing wp_capabilities or wp_user_level parameters.
# Update Academy LMS via WP-CLI and confirm version
wp plugin update academy
wp plugin get academy --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
