CVE-2015-10139

The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wp_ajax_import_data' AJAX action. This makes it possible for authenticated attackers to change otherwise restricted settings and potentially create a new accessible admin account.

• CWE-269

• https://packetstormsecurity.com/files/130291/Exploit, Third Party Advisory
• https://themeforest.net/item/wplms-learning-management-system/6780226Product
• https://twitter.com/_wpscan_/status/564874637679820800?lang=caBroken Link
• https://wpscan.com/vulnerability/7785Broken Link
• https://www.rapid7.com/db/modules/auxiliary/admin/http/wp_wplms_privilege_escalation/Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6e0e8f5f-8216-4276-a810-860f9b52c447?source=cveThird Party Advisory

Published

Jul 19, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-10133The Subscribe to Comments for WordPress is vulnerable to Loc…7.2
• CVE-2015-10134The Simple Backup plugin for WordPress is vulnerable to Arbi…7.5
• CVE-2015-10135The WPshop 2 – E-Commerce plugin for WordPress is vulnerable…9.8
• CVE-2015-10136The GI-Media Library plugin for WordPress is vulnerable to D…7.5
• CVE-2015-10137The Website Contact Form With File Upload plugin for WordPre…9.8
• CVE-2015-10138The Work The Flow File Upload plugin for WordPress is vulner…9.8
• CVE-2015-1014A successful exploit of these vulnerabilities requires the l…
• CVE-2015-10140The Ajax Load More plugin before 2.8.1.2 does not have autho…8.8
• CVE-2015-10141An unauthenticated OS command injection vulnerability exists…9.3
• CVE-2015-10142Sitecore Experience Platform (XP) prior to 8.0 Initial Relea…6.9
• CVE-2015-10143The Platform theme for WordPress is vulnerable to unauthoriz…9.8
• CVE-2015-10144The Responsive Thumbnail Slider plugin for WordPress is vuln…8.8