CVE-2025-14156: Fox LMS Plugin Privilege Escalation Flaw

CVE-2025-14156 Overview

The Fox LMS – WordPress LMS Plugin for WordPress contains a privilege escalation vulnerability that allows unauthenticated attackers to create new user accounts with arbitrary roles, including administrator. The vulnerability exists in all versions up to and including 1.0.5.1 due to improper validation of the role parameter when creating new users via the /fox-lms/v1/payments/create-order REST API endpoint. Successful exploitation leads to complete site compromise.

Critical Impact

Unauthenticated attackers can create administrator accounts on vulnerable WordPress sites, resulting in complete site takeover with full administrative access to content, users, and site configuration.

Affected Products

• Fox LMS – WordPress LMS Plugin versions up to and including 1.0.5.1
• WordPress installations with the vulnerable Fox LMS plugin active
• All WordPress sites exposing the /fox-lms/v1/payments/create-order REST API endpoint

Discovery Timeline

• December 15, 2025 - CVE-2025-14156 published to NVD
• December 15, 2025 - Last updated in NVD database

Technical Details for CVE-2025-14156

Vulnerability Analysis

This privilege escalation vulnerability stems from insufficient input validation in the Fox LMS plugin's REST API payment processing functionality. The vulnerable endpoint /fox-lms/v1/payments/create-order accepts user registration data including a role parameter without proper authorization checks or validation. Since the endpoint is accessible to unauthenticated users and fails to restrict role assignment to safe defaults, attackers can specify any WordPress role including administrator when creating new accounts.

The vulnerability is classified under CWE-20 (Improper Input Validation), reflecting the core issue of accepting and processing user-controlled role parameters without adequate security controls.

Root Cause

The root cause lies in the Payments.php file within the plugin's REST API implementation. The code processes the role parameter from incoming requests during user account creation without validating that:

1. The request originates from an authenticated administrator
2. The requested role is within acceptable bounds for public registration
3. The role value matches expected safe defaults (such as subscriber)

This oversight allows direct role assignment through an unauthenticated API call, bypassing WordPress's standard user registration role controls.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can send a crafted POST request to the vulnerable REST API endpoint with a malicious payload specifying administrator as the role value. The attack flow follows this sequence:

1. Attacker identifies a WordPress site running a vulnerable version of Fox LMS
2. Attacker crafts a POST request to /wp-json/fox-lms/v1/payments/create-order
3. The request includes attacker-controlled user credentials and sets role to administrator
4. The plugin creates a new user account with full administrative privileges
5. Attacker logs in with the newly created administrator credentials
6. Attacker gains complete control over the WordPress installation

The vulnerability requires no complex exploitation techniques and can be automated for mass scanning and compromise of vulnerable WordPress installations.

Detection Methods for CVE-2025-14156

Indicators of Compromise

• Unexpected administrator or high-privilege user accounts created without legitimate authorization
• Suspicious POST requests to /wp-json/fox-lms/v1/payments/create-order with unusual role parameter values
• New user accounts created with administrator privileges that don't match normal registration patterns
• Log entries showing REST API calls to the Fox LMS payment endpoint from unknown IP addresses

Detection Strategies

• Monitor WordPress user creation events for accounts with elevated roles created outside normal administrative workflows
• Implement web application firewall (WAF) rules to inspect and alert on POST requests to the vulnerable endpoint containing role parameter with privileged values
• Review access logs for patterns of reconnaissance or exploitation attempts targeting Fox LMS REST API endpoints
• Enable WordPress audit logging to track all user account creation events and role assignments

Monitoring Recommendations

• Configure alerting for any new administrator account creation that bypasses the WordPress admin dashboard
• Set up real-time monitoring for REST API abuse patterns targeting plugin endpoints
• Implement anomaly detection for user registration activity, particularly accounts with elevated privileges
• Review REST API access logs regularly for requests to /fox-lms/v1/ endpoints from untrusted sources

How to Mitigate CVE-2025-14156

Immediate Actions Required

• Update Fox LMS plugin immediately to version 1.0.5.2 or later, which contains the security fix
• Audit existing WordPress user accounts for any unauthorized administrator or elevated-privilege accounts created during the exposure window
• Remove or disable any suspicious accounts discovered during the audit
• Review site access logs for evidence of exploitation attempts
• Consider temporarily disabling the Fox LMS plugin if immediate update is not possible

Patch Information

The vulnerability has been addressed in Fox LMS version 1.0.5.2. The fix adds proper validation to the role parameter in the Payments.php REST API handler. Site administrators should update through the WordPress plugin update mechanism or by downloading the patched version from the WordPress Plugin Repository. For additional technical details, refer to the Wordfence Vulnerability Report.

Workarounds

• Implement a WAF rule to block POST requests to /wp-json/fox-lms/v1/payments/create-order containing role parameter values other than subscriber
• Temporarily disable REST API access to the Fox LMS payment endpoints if business operations permit
• Use a security plugin to restrict REST API access to authenticated users only as a temporary measure
• Consider network-level blocking of the vulnerable endpoint until the patch can be applied

# Apache .htaccess rule to block unauthenticated access to vulnerable endpoint
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/fox-lms/v1/payments/create-order
RewriteCond %{HTTP:Authorization} ^$
RewriteRule .* - [F,L]
</IfModule>