CVE-2025-13398: Duplicate CVE ID Rejected for WordPress LMS

CVE-2025-13398 Overview

CVE-2025-13398 is a rejected CVE identifier. MITRE and the CVE Numbering Authority determined this ID was a duplicate assignment and was never published as a valid vulnerability record. Both CVE-2025-13398 and CVE-2025-13542 were assigned to the same underlying issue: an unauthenticated privilege escalation vulnerability in the DesignThemes LMS plugin for WordPress. All references, tooling, and vulnerability management workflows should use CVE-2025-13542 as the authoritative identifier. This record exists only to preserve the rejection history and redirect consumers to the correct CVE.

Critical Impact
This CVE ID has been rejected. Reference CVE-2025-13542 for the actual unauthenticated privilege escalation vulnerability in the DesignThemes LMS WordPress plugin.

Affected Products

No products are affected under this CVE ID
The underlying vulnerability affects the DesignThemes LMS WordPress plugin (see CVE-2025-13542)
Not Available

Discovery Timeline

2026-09-02 - CVE-2025-13398 published to NVD in REJECTED status
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2025-13398

Vulnerability Analysis

CVE-2025-13398 contains no technical vulnerability content. The CVE Numbering Authority rejected this identifier because it duplicates CVE-2025-13542, which tracks an unauthenticated privilege escalation issue in the DesignThemes LMS WordPress plugin. Duplicate CVE assignments occur when multiple submissions describe the same defect or when internal CNA workflows produce parallel identifiers before deduplication. Consumers should treat this ID as invalid for scanning, ticketing, and reporting purposes.

Root Cause

The root cause of the rejection is administrative rather than technical. Two CVE identifiers were assigned to a single vulnerability, and the CNA retired CVE-2025-13398 in favor of CVE-2025-13542. No code, configuration, or product weakness is associated with this specific identifier.

Attack Vector

No attack vector applies to this rejected identifier. For attack vector details covering the underlying privilege escalation flaw, refer to the authoritative record at CVE-2025-13542.

No verified exploitation code is associated with this rejected CVE identifier. Consult the CVE-2025-13542 advisory for technical details covering the DesignThemes LMS plugin issue.

Detection Methods for CVE-2025-13398

Indicators of Compromise

No indicators of compromise exist for this rejected CVE identifier.
Detection engineering should target CVE-2025-13542, which tracks the actual privilege escalation vulnerability.

Detection Strategies

Update vulnerability management tooling to suppress CVE-2025-13398 and map any historical references to CVE-2025-13542.
Audit scanner outputs and ticketing systems to consolidate duplicate findings under the authoritative identifier.

Monitoring Recommendations

Monitor WordPress installations for the DesignThemes LMS plugin and track patch status against CVE-2025-13542.
Review CVE feeds for future modifications to the rejection status of this identifier.

How to Mitigate CVE-2025-13398

Immediate Actions Required

Redirect all remediation activity to CVE-2025-13542, which is the valid identifier for the underlying vulnerability.
Update internal knowledge bases, runbooks, and compliance reports to remove references to CVE-2025-13398.
Verify that vulnerability scanners do not double-count findings across both identifiers.

Patch Information

No patch is associated with CVE-2025-13398 because it was never published as a valid CVE. Patch guidance for the DesignThemes LMS WordPress plugin privilege escalation vulnerability is tracked under CVE-2025-13542. Consult the vendor advisory referenced there for supported plugin versions and update instructions.

Workarounds

No workarounds are required for this rejected identifier.
Apply the mitigations documented under CVE-2025-13542 to address the underlying privilege escalation risk.