CVE-2025-14156: Fox LMS Plugin Privilege Escalation Flaw

CVE-2025-14156 Overview

The Fox LMS – WordPress LMS Plugin for WordPress contains a privilege escalation vulnerability that allows unauthenticated attackers to create new user accounts with arbitrary roles, including administrator. The vulnerability exists in all versions up to and including 1.0.5.1 due to improper validation of the role parameter when creating new users via the /fox-lms/v1/payments/create-order REST API endpoint. Successful exploitation leads to complete site compromise.

Critical Impact
Unauthenticated attackers can create administrator accounts on vulnerable WordPress sites, resulting in complete site takeover with full administrative access to content, users, and site configuration.

Affected Products

Fox LMS – WordPress LMS Plugin versions up to and including 1.0.5.1
WordPress installations with the vulnerable Fox LMS plugin active
All WordPress sites exposing the /fox-lms/v1/payments/create-order REST API endpoint

Discovery Timeline

December 15, 2025 - CVE-2025-14156 published to NVD
December 15, 2025 - Last updated in NVD database

Technical Details for CVE-2025-14156

Vulnerability Analysis

This privilege escalation vulnerability stems from insufficient input validation in the Fox LMS plugin's REST API payment processing functionality. The vulnerable endpoint /fox-lms/v1/payments/create-order accepts user registration data including a role parameter without proper authorization checks or validation. Since the endpoint is accessible to unauthenticated users and fails to restrict role assignment to safe defaults, attackers can specify any WordPress role including administrator when creating new accounts.

The vulnerability is classified under CWE-20 (Improper Input Validation), reflecting the core issue of accepting and processing user-controlled role parameters without adequate security controls.

Root Cause

The root cause lies in the Payments.php file within the plugin's REST API implementation. The code processes the role parameter from incoming requests during user account creation without validating that:

The request originates from an authenticated administrator
The requested role is within acceptable bounds for public registration
The role value matches expected safe defaults (such as subscriber)

This oversight allows direct role assignment through an unauthenticated API call, bypassing WordPress's standard user registration role controls.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can send a crafted POST request to the vulnerable REST API endpoint with a malicious payload specifying administrator as the role value. The attack flow follows this sequence:

Attacker identifies a WordPress site running a vulnerable version of Fox LMS
Attacker crafts a POST request to /wp-json/fox-lms/v1/payments/create-order
The request includes attacker-controlled user credentials and sets role to administrator
The plugin creates a new user account with full administrative privileges
Attacker logs in with the newly created administrator credentials
Attacker gains complete control over the WordPress installation

The vulnerability requires no complex exploitation techniques and can be automated for mass scanning and compromise of vulnerable WordPress installations.

Detection Methods for CVE-2025-14156

Indicators of Compromise

Unexpected administrator or high-privilege user accounts created without legitimate authorization
Suspicious POST requests to /wp-json/fox-lms/v1/payments/create-order with unusual role parameter values
New user accounts created with administrator privileges that don't match normal registration patterns
Log entries showing REST API calls to the Fox LMS payment endpoint from unknown IP addresses

Detection Strategies

Monitor WordPress user creation events for accounts with elevated roles created outside normal administrative workflows
Implement web application firewall (WAF) rules to inspect and alert on POST requests to the vulnerable endpoint containing role parameter with privileged values
Review access logs for patterns of reconnaissance or exploitation attempts targeting Fox LMS REST API endpoints
Enable WordPress audit logging to track all user account creation events and role assignments

Monitoring Recommendations

Configure alerting for any new administrator account creation that bypasses the WordPress admin dashboard
Set up real-time monitoring for REST API abuse patterns targeting plugin endpoints
Implement anomaly detection for user registration activity, particularly accounts with elevated privileges
Review REST API access logs regularly for requests to /fox-lms/v1/ endpoints from untrusted sources

How to Mitigate CVE-2025-14156

Immediate Actions Required

Update Fox LMS plugin immediately to version 1.0.5.2 or later, which contains the security fix
Audit existing WordPress user accounts for any unauthorized administrator or elevated-privilege accounts created during the exposure window
Remove or disable any suspicious accounts discovered during the audit
Review site access logs for evidence of exploitation attempts
Consider temporarily disabling the Fox LMS plugin if immediate update is not possible

Patch Information

The vulnerability has been addressed in Fox LMS version 1.0.5.2. The fix adds proper validation to the role parameter in the Payments.php REST API handler. Site administrators should update through the WordPress plugin update mechanism or by downloading the patched version from the WordPress Plugin Repository. For additional technical details, refer to the Wordfence Vulnerability Report.

Workarounds

Implement a WAF rule to block POST requests to /wp-json/fox-lms/v1/payments/create-order containing role parameter values other than subscriber
Temporarily disable REST API access to the Fox LMS payment endpoints if business operations permit
Use a security plugin to restrict REST API access to authenticated users only as a temporary measure
Consider network-level blocking of the vulnerable endpoint until the patch can be applied

bash

# Apache .htaccess rule to block unauthenticated access to vulnerable endpoint
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/fox-lms/v1/payments/create-order
RewriteCond %{HTTP:Authorization} ^$
RewriteRule .* - [F,L]
</IfModule>