CVE-2025-12098 Overview
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution contains a sensitive information exposure vulnerability affecting all versions up to and including 3.3.8. The flaw resides in the enqueue_social_login_script function, which exposes configuration data to unauthenticated visitors. When Facebook Social Login is enabled, attackers can extract the Facebook App Secret without authentication. The issue is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
Critical Impact
Unauthenticated network attackers can retrieve the Facebook App Secret from vulnerable WordPress sites, enabling impersonation of the site's Facebook application and potential account takeover of connected social login sessions.
Affected Products
- Academy LMS – WordPress LMS Plugin for Complete eLearning Solution (all versions ≤ 3.3.8)
- WordPress sites with Facebook Social Login enabled through the plugin
- Learning management deployments relying on Academy LMS social authentication
Discovery Timeline
- 2025-11-08 - CVE-2025-12098 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12098
Vulnerability Analysis
The vulnerability exists in the enqueue_social_login_script function within the Academy LMS plugin. This function loads client-side scripts required for social login integration but embeds sensitive server-side credentials in the output delivered to browsers. Because the function runs on public-facing pages, any unauthenticated visitor can retrieve the exposed data by inspecting the page source or the enqueued script content.
The primary secret at risk is the Facebook App Secret, a credential intended to remain server-side. Facebook App Secrets authenticate the WordPress site to Facebook's OAuth infrastructure. Once disclosed, an attacker holding both the App ID and App Secret can request access tokens, call Graph API endpoints on behalf of the application, and manipulate OAuth flows tied to the site.
Root Cause
The root cause is improper separation between client-side and server-side configuration data. The enqueue_social_login_script function passes secret credentials to wp_localize_script or an equivalent output mechanism instead of using them only in server-to-server OAuth exchanges. This design flaw treats a confidential credential as if it were a public parameter.
Attack Vector
An attacker sends an unauthenticated HTTP request to any page of the WordPress site that triggers the social login script enqueue. The server responds with HTML containing the leaked Facebook App Secret in an inline JavaScript block or referenced script. The attacker parses the response, extracts the credential, and uses it against Facebook's OAuth endpoints to obtain application-level access tokens. Exploitation requires no user interaction and no privileges.
See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-12098
Indicators of Compromise
- Unauthenticated HTTP GET requests to WordPress pages that enqueue Academy LMS social login scripts, particularly from scanning infrastructure.
- Unexpected Facebook Graph API activity originating from IP addresses not associated with the WordPress host.
- Facebook developer console alerts indicating anomalous App Secret usage or token generation.
Detection Strategies
- Review page source and enqueued script output on Academy LMS pages for any variables containing app_secret, client_secret, or Facebook credential strings.
- Audit web server access logs for automated crawlers or vulnerability scanners hitting endpoints where the social login script is registered.
- Correlate WordPress plugin version inventories against the vulnerable range (≤ 3.3.8) using asset management data.
Monitoring Recommendations
- Enable Facebook Login security notifications and monitor the App Dashboard for unauthorized token requests.
- Log outbound OAuth callback traffic and alert on Graph API calls that do not originate from the WordPress server.
- Track plugin file integrity and configuration changes to detect tampering following credential disclosure.
How to Mitigate CVE-2025-12098
Immediate Actions Required
- Update the Academy LMS plugin to a version above 3.3.8 as soon as a patched release is available from the vendor.
- Rotate the Facebook App Secret immediately in the Facebook Developer Console if Facebook Social Login was ever enabled on an affected site.
- Invalidate all active OAuth tokens issued under the exposed application credentials.
- Audit connected user accounts for suspicious social login sessions and terminate unrecognized ones.
Patch Information
Refer to the vendor changelog at Academy LMS Updates for the fixed release addressing the enqueue_social_login_script disclosure. Confirm the installed plugin version reports higher than 3.3.8 after upgrade. Coordinate the update through a WordPress staging environment before applying to production to validate compatibility with existing course content.
Workarounds
- Disable the Facebook Social Login feature within Academy LMS settings until the patched version is installed.
- Remove the Facebook App Secret from the plugin configuration and rely on alternative authentication providers temporarily.
- Restrict access to WordPress pages that enqueue social login scripts through a web application firewall rule targeting the vulnerable script handle.
# Configuration example: verify installed plugin version and disable social login via WP-CLI
wp plugin get academy --field=version
wp option patch update academy_settings facebook_social_login 0
wp cache flush
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
