CVE-2026-12153: WP Learn Manager Auth Bypass Vulnerability

CVE-2026-12153 Overview

CVE-2026-12153 is an authorization bypass vulnerability in the WP Learn Manager plugin for WordPress, affecting all versions up to and including 1.1.8. The plugin fails to verify that a user is authorized to perform sensitive actions exposed through its AJAX endpoints. Unauthenticated attackers can leverage this flaw to install and activate arbitrary plugins from the WordPress.org repository on a vulnerable site. Installing attacker-chosen plugins creates a pivot for full site compromise, including remote code execution through subsequently installed vulnerable or malicious plugin code. The issue is categorized under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated attackers can install and activate arbitrary WordPress.org plugins on vulnerable sites, enabling full site takeover.

Affected Products

WP Learn Manager plugin for WordPress, versions ≤ 1.1.8
WordPress installations exposing the plugin's AJAX endpoints (includes/ajax.php)
Sites running the jslearnmanager module (modules/jslearnmanager/model.php)

Discovery Timeline

2026-07-08 - CVE-2026-12153 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-12153

Vulnerability Analysis

The WP Learn Manager plugin registers AJAX actions that trigger plugin installation and activation logic. The handlers in includes/ajax.php do not perform a capability check (such as current_user_can('install_plugins')) and do not validate an authenticated nonce before invoking privileged operations. Because WordPress exposes wp-admin/admin-ajax.php to unauthenticated requests through the wp_ajax_nopriv_ hook family, any remote actor reaching the site can invoke the vulnerable actions. The downstream methods in modules/jslearnmanager/model.php around lines 879 and 920 proceed to fetch, install, and activate a plugin identified by attacker-controlled input.

Root Cause

The root cause is missing authorization on state-changing AJAX endpoints. The plugin conflates "the endpoint is registered" with "the caller is entitled to use it," omitting both role checks and nonce verification. This aligns with CWE-862 (Missing Authorization) and reflects a broken access control design rather than an input parsing flaw.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends a crafted HTTP POST to admin-ajax.php specifying the vulnerable action and a target plugin slug from the WordPress.org repository. The handler installs the requested plugin and activates it without authentication. The attacker then chains any plugin with known vulnerabilities to achieve remote code execution, persistence, or data theft. No user interaction is required.

See the WordPress Learn Manager ajax.php source and model.php source for the vulnerable code paths.

Detection Methods for CVE-2026-12153

Indicators of Compromise

Unexpected plugins present in wp-content/plugins/ that were not installed by an administrator.
Entries in active_plugins inside the wp_options table that predate no known administrative action.
HTTP POST requests to /wp-admin/admin-ajax.php from unauthenticated sources referencing WP Learn Manager AJAX actions.
Outbound requests from the web server to downloads.wordpress.org at times not correlated with admin activity.

Detection Strategies

Inspect web server access logs for unauthenticated POSTs to admin-ajax.php targeting WP Learn Manager action names.
Compare the current plugin inventory against a known-good baseline and alert on additions.
Monitor WordPress core hooks (activated_plugin) via a logging plugin or SIEM forwarder for activations without an associated admin session ID.

Monitoring Recommendations

Forward WordPress audit logs and web access logs to a centralized analytics platform for correlation with authentication events.
Alert on any plugin install or activation that lacks a corresponding authenticated admin session in the same request chain.
Baseline outbound network egress from web servers and flag unexpected downloads from the plugin repository.

How to Mitigate CVE-2026-12153

Immediate Actions Required

Deactivate and remove the WP Learn Manager plugin until a patched version is confirmed available.
Audit wp-content/plugins/ and the active_plugins option for unauthorized additions and remove them.
Rotate all administrator credentials and review user accounts for unexpected privileged users.
Review the site for webshells, modified core files, and scheduled tasks (wp_cron) added by installed plugins.

Patch Information

No fixed version is listed in the enriched advisory data at time of publication. Consult the Wordfence advisory for CVE-2026-12153 and the WP Learn Manager plugin repository for updated release information.

Workarounds

Block requests to admin-ajax.php targeting WP Learn Manager actions at the web application firewall until a patch is applied.
Restrict access to /wp-admin/ by IP allowlist where operationally feasible.
Enforce filesystem write restrictions so that the web user cannot install new plugins (define('DISALLOW_FILE_MODS', true); in wp-config.php).

bash

# Configuration example: disable plugin/theme installation site-wide
# Add to wp-config.php
define('DISALLOW_FILE_MODS', true);