CVE-2025-2290: LifterLMS Auth Bypass Vulnerability

CVE-2025-2290 Overview

CVE-2025-2290 affects the LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress. The vulnerability stems from a missing capability check on the delete_access_plan function and its related AJAX handlers. All versions up to and including 8.0.1 are affected.

Unauthenticated attackers can change the status of any published post to "Trash", limiting content availability on the site. The flaw is classified as [CWE-862] Missing Authorization. The issue was patched in the plugin trunk via a commit to class.llms.ajax.handler.php.

Critical Impact
Unauthenticated attackers can trash any published WordPress post on affected sites, causing content availability loss across the entire installation.

Affected Products

LifterLMS Plugin for WordPress versions up to and including 8.0.1
WordPress sites using LifterLMS for eLearning and online courses
All installations exposing the vulnerable AJAX endpoint over the network

Discovery Timeline

2025-03-19 - CVE CVE-2025-2290 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2290

Vulnerability Analysis

The vulnerability resides in the delete_access_plan function within the LifterLMS AJAX handler. The function processes requests to remove access plans but omits a capability check to verify that the requester has permission to perform the action. AJAX endpoints that call this function are reachable without authentication.

An attacker sends a crafted request to the AJAX handler, referencing a post ID. The plugin executes the trash operation on the target post without validating the user's role or capability. This exposes every published post on the site to unauthorized status changes.

The issue is a Broken Access Control flaw and is tracked under [CWE-862] Missing Authorization. The impact is limited to integrity of post status; confidentiality and availability of underlying data are not directly affected, though site content becomes inaccessible to visitors while trashed.

Root Cause

The root cause is the absence of a current_user_can() capability check and nonce verification within the delete_access_plan handler. The plugin trusts the incoming AJAX request without enforcing authorization boundaries between administrators, subscribers, and unauthenticated users.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker crafts an HTTP request to admin-ajax.php targeting the vulnerable action, supplying arbitrary post identifiers. Automated scripts can enumerate post IDs and mass-trash content in a single session.

No public proof-of-concept exploit is currently listed in ExploitDB, and this CVE is not on the CISA Known Exploited Vulnerabilities list. The fix is visible in the WordPress Plugin Changeset, which adds the missing authorization logic. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-2290

Indicators of Compromise

Sudden appearance of published posts in the Trash bin without a corresponding admin action in the WordPress audit log
POST requests to /wp-admin/admin-ajax.php referencing LifterLMS delete_access_plan action from unauthenticated sessions
Elevated 200-response rates on AJAX endpoints originating from single source IPs or scanning tools

Detection Strategies

Monitor WordPress database changes on the wp_posts table for bulk post_status transitions to trash
Inspect web server access logs for anomalous POST volume against admin-ajax.php correlated with LifterLMS action parameters
Deploy WordPress security plugins that log AJAX action invocations and flag unauthenticated calls to privileged handlers

Monitoring Recommendations

Enable file integrity monitoring on the LifterLMS plugin directory to detect version drift
Alert on posts transitioning from publish to trash outside business hours or in rapid succession
Track HTTP request rates to admin-ajax.php and baseline normal traffic to catch spikes

How to Mitigate CVE-2025-2290

Immediate Actions Required

Update the LifterLMS plugin to the version released after 8.0.1 that includes changeset 3257328
Audit the WordPress Trash for any posts that were removed without administrator action and restore as needed
Restrict access to /wp-admin/admin-ajax.php via a Web Application Firewall (WAF) rule where feasible

Patch Information

The vendor addressed the issue in the plugin trunk. The fix adds capability verification to the delete_access_plan AJAX handler. Details are available in the LifterLMS WordPress Plugin Changeset 3257328. Site administrators should install the patched release through the WordPress plugin updater.

Workarounds

Disable the LifterLMS plugin until the patched version can be installed if immediate updating is not possible
Apply WAF rules that block unauthenticated POST requests to admin-ajax.php referencing the delete_access_plan action
Restrict admin-ajax.php access by IP allowlist for administrative networks where feasible

bash

# Example WAF rule (ModSecurity) to block unauthenticated delete_access_plan calls
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1002290,msg:'Block LifterLMS CVE-2025-2290'"
  SecRule ARGS:action "@streq llms_delete_access_plan" \
  "chain"
  SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"