CVE-2025-12099: Academy LMS Plugin Object Injection Flaw

CVE-2025-12099 Overview

CVE-2025-12099 is a PHP Object Injection vulnerability in the Academy LMS – WordPress LMS Plugin for Complete eLearning Solution. The flaw affects all versions up to and including 3.3.8. The plugin deserializes untrusted input inside the import_all_courses function, allowing authenticated attackers with Administrator-level access to inject arbitrary PHP objects. The vulnerability maps to [CWE-502: Deserialization of Untrusted Data].

Critical Impact
Administrator-level attackers can inject PHP objects through import_all_courses. When a Property-Oriented Programming (POP) chain exists in another installed plugin or theme, exploitation can result in arbitrary file deletion, sensitive data retrieval, or remote code execution.

Affected Products

Academy LMS – WordPress LMS Plugin for Complete eLearning Solution (all versions ≤ 3.3.8)
WordPress sites running the vulnerable plugin alongside any plugin or theme containing a usable POP chain
Multi-site WordPress installations where administrators import course data

Discovery Timeline

2025-11-08 - CVE-2025-12099 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12099

Vulnerability Analysis

The vulnerability resides in the import_all_courses AJAX handler defined in includes/ajax/course.php. The handler passes attacker-controlled input into PHP's unserialize() function without validation. Any authenticated user holding Administrator privileges can submit a crafted serialized payload through the import workflow.

The plugin itself contains no exploitable POP chain. Impact therefore depends on the broader site composition. WordPress installations frequently load multiple themes and plugins, many of which expose magic methods such as __destruct, __wakeup, or __toString. An attacker can chain these methods to manipulate file operations, database queries, or arbitrary function calls.

The required Administrator privilege reduces the attacker pool but does not eliminate risk. Compromised administrator credentials, supply-chain attacks against staff accounts, and rogue insiders all create realistic exploitation paths.

Root Cause

The root cause is unsafe use of unserialize() on input received from an HTTP request. PHP's native deserialization reconstructs objects of any declared class, triggering their magic methods during instantiation and destruction. The Academy LMS code path lacked allow-list validation, JSON-based serialization, or signed payload verification.

Attack Vector

Exploitation requires authenticated access at the Administrator role or higher. The attacker submits a crafted serialized object to the import_all_courses endpoint. The plugin deserializes the payload, instantiating attacker-chosen classes drawn from any loaded plugin or theme. If a usable POP chain is present, the resulting object graph executes attacker logic during PHP's object lifecycle events.

The vulnerable code path is documented in the WordPress Plugin Code Review. The corrective patch is published in the WordPress Changeset Update.

Detection Methods for CVE-2025-12099

Indicators of Compromise

POST requests targeting the import_all_courses AJAX action containing serialized PHP markers such as O:, a:, or s: followed by class names
Unexpected file deletions, new PHP files in wp-content/uploads, or modified .htaccess entries following administrator activity
PHP error log entries referencing __wakeup, __destruct, or class instantiation failures during course import operations
Outbound network connections initiated by the PHP-FPM or webserver process immediately after an import request

Detection Strategies

Inspect web server access logs for admin-ajax.php requests with the import_all_courses action originating from unexpected IP addresses or user agents
Deploy a Web Application Firewall (WAF) rule that flags serialized PHP object patterns in POST bodies destined for WordPress admin endpoints
Hash and baseline plugin files, then alert on changes to includes/ajax/course.php and adjacent handlers

Monitoring Recommendations

Forward WordPress audit logs, PHP error logs, and webserver access logs to a centralized SIEM for correlation
Track administrator session activity, including geographic anomalies and concurrent sessions, to identify credential abuse
Alert on creation or modification of cron entries, scheduled tasks, and option rows in wp_options immediately following import requests

How to Mitigate CVE-2025-12099

Immediate Actions Required

Update the Academy LMS plugin to a version newer than 3.3.8 as published in Changeset 3390420
Audit all Administrator accounts, rotate passwords, and enforce multi-factor authentication on privileged WordPress roles
Inventory installed plugins and themes, removing unused components that expand the POP-chain surface
Review recent imports and administrator activity for signs of exploitation before applying the patch

Patch Information

The maintainers addressed the deserialization sink in the Academy LMS repository. Site operators should install the patched release through the WordPress plugin updater. Details of the code change are tracked in the Wordfence Vulnerability Report and the upstream changeset.

Workarounds

Restrict access to wp-admin and admin-ajax.php using IP allow-lists at the reverse proxy or WAF layer
Temporarily deactivate the Academy LMS plugin on sites that cannot patch immediately
Block POST requests containing serialized PHP object signatures targeting the import_all_courses action via WAF rules

bash

# Example ModSecurity rule blocking serialized PHP objects to the vulnerable AJAX action
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,id:1012099,phase:2,deny,status:403,msg:'Academy LMS PHP Object Injection attempt (CVE-2025-12099)'"
  SecRule ARGS:action "@streq import_all_courses" \
    "chain"
    SecRule REQUEST_BODY "@rx O:[0-9]+:\"[A-Za-z0-9_\\\\]+\":[0-9]+:\{" "t:none"