CVE-2025-11923: LifterLMS Privilege Escalation Flaw

CVE-2025-11923 Overview

CVE-2025-11923 is a privilege escalation vulnerability in the LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress. The plugin fails to properly validate a user's identity before allowing them to modify their own role through the REST API. The update_item_permissions_check() function returns true when a user updates their own account without verifying whether the request modifies the roles array. Authenticated attackers with student-level access or above can escalate their privileges to administrator by submitting a crafted REST API request. A separate endpoint intended for instructors also provides an attack vector.

Critical Impact
Any authenticated user, including students, can promote themselves to administrator, resulting in full compromise of the affected WordPress site.

Affected Products

LifterLMS plugin versions 3.5.3 through 3.41.2
LifterLMS plugin versions 4.0.0 through 4.21.3, 5.0.0 through 5.10.0, and 6.0.0 through 6.11.0
LifterLMS plugin versions 7.0.0 through 7.8.7, 8.0.0 through 8.0.7, 9.0.0 through 9.0.7, and 9.1.0

Discovery Timeline

2025-11-13 - CVE-2025-11923 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11923

Vulnerability Analysis

The flaw resides in the LifterLMS REST API user controller. The update_item_permissions_check() function in class-llms-rest-users-controller.php grants a user permission to update their own account. However, the check does not inspect the request body to determine whether the roles parameter is being modified. An authenticated student can therefore issue a POST or PUT request to their own user endpoint and include a roles array containing administrator. The controller writes the elevated role to the user record, granting full administrative capabilities on the WordPress site. A parallel endpoint in class-llms-rest-students-controller.php exposes the same weakness for instructor-facing operations. This weakness is classified as Improper Privilege Management [CWE-269].

Root Cause

The root cause is missing authorization logic that distinguishes between self-editing profile fields and self-editing sensitive role assignments. WordPress core enforces role changes only through the edit_users capability, but the LifterLMS REST controller bypasses that gate by permitting arbitrary field updates whenever the request targets the current user.

Attack Vector

The attack requires network access to the target site and low-privileged authenticated credentials such as a student account created through open registration. The attacker sends a REST API request to the LifterLMS user endpoint, targeting their own user ID, with a JSON body that sets the roles field to ["administrator"]. Once the request is processed, the account gains administrative privileges and can install plugins, upload arbitrary PHP, or exfiltrate data. See the WordPress Plugin Code Analysis for the vulnerable permission check, and the Wordfence Vulnerability Report for additional context.

Detection Methods for CVE-2025-11923

Indicators of Compromise

REST API requests to /wp-json/llms/v1/students/<id> or /wp-json/llms/v1/instructors/<id> containing a roles field in the request body.
Unexpected promotion of student or instructor accounts to administrator in the wp_usermeta table.
New administrator accounts creating additional users, installing plugins, or uploading files shortly after registering as students.

Detection Strategies

Inspect WordPress access logs for POST or PUT requests to LifterLMS REST endpoints where the requesting user is not already an administrator.
Audit the wp_usermeta table for wp_capabilities values containing administrator on accounts that were created with lower-privileged roles.
Correlate role change events with the originating IP address and session to identify self-service escalation.

Monitoring Recommendations

Enable request body logging on the web application firewall or reverse proxy for LifterLMS REST endpoints.
Alert on any change to the roles field in user update requests where the source account is not an administrator.
Track administrator account count as a baseline metric and generate alerts on unexpected growth.

How to Mitigate CVE-2025-11923

Immediate Actions Required

Update the LifterLMS plugin to a fixed release that includes the changeset referenced in the WordPress Plugin Change Log.
Review all administrator accounts and remove any that were created through unauthorized role escalation.
Rotate credentials and session tokens for any account that had administrative privileges during the exposure window.

Patch Information

The LifterLMS maintainers released a fix in the changeset published on the WordPress plugin repository. Site owners should upgrade beyond the vulnerable ranges (3.5.3–3.41.2, 4.0.0–4.21.3, 5.0.0–5.10.0, 6.0.0–6.11.0, 7.0.0–7.8.7, 8.0.0–8.0.7, 9.0.0–9.0.7, and 9.1.0) to the current stable release. Reference the Wordfence Vulnerability Report for the confirmed fixed version.

Workarounds

Disable open user registration or restrict registration to the default WordPress subscriber role until the plugin is patched.
Deploy a web application firewall rule that blocks REST requests to LifterLMS user endpoints containing a roles field in the JSON body.
Temporarily disable the LifterLMS REST API integration if the site does not require external API access.

bash

# Example WAF rule (ModSecurity) blocking role modification via LifterLMS REST
SecRule REQUEST_URI "@rx /wp-json/llms/v1/(students|instructors)/[0-9]+" \
  "phase:2,deny,status:403,id:1011923,\
   chain,msg:'Block LifterLMS role escalation CVE-2025-11923'"
  SecRule REQUEST_BODY "@rx \"roles\"\s*:" "t:none"