CVE-2025-11923

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not properly validating a user's identity prior to allowing them to modify their own role via the REST API. The permission check in the update_item_permissions_check() function returns true when a user updates their own account without verifying the role changes. This makes it possible for authenticated attackers, with student-level access and above, to escalate their privileges to administrator by updating their own roles array via a crafted REST API request. Another endpoint intended for instructors also provides an attack vector. Affected version ranges are 3.5.3-3.41.2, 4.0.0-4.21.3, 5.0.0-5.10.0, 6.0.0-6.11.0, 7.0.0-7.8.7, 8.0.0-8.0.7, 9.0.0-9.0.7, 9.1.0.

• CWE-269

• https://plugins.trac.wordpress.org/browser/lifterlms/trunk/libraries/lifterlms-rest/includes/abstracts/class-llms-rest-users-controller.php#L721
• https://plugins.trac.wordpress.org/browser/lifterlms/trunk/libraries/lifterlms-rest/includes/server/class-llms-rest-students-controller.php#L386
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3393703%40lifterlms%2Ftrunk&old=3388956%40lifterlms%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/cc13d13c-6b79-4bf1-8e77-c8cb836dc0c5?source=cve

Published

Nov 13, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11918Rockwell Automation Arena® suffers from a stack-based buffer…7.3
• CVE-2025-11919The default JVM can access files and directories under `/tmp…9.6
• CVE-2025-1192A vulnerability was found in SourceCodester Multi Restaurant…8.8
• CVE-2025-11920The WPCOM Member plugin for WordPress is vulnerable to Local…8.8
• CVE-2025-11921iStats contains an insecure XPC service that allows local, u…8.5
• CVE-2025-11922The Inactive Logout plugin for WordPress is vulnerable to St…6.4
• CVE-2025-11924The Ninja Forms – The Contact Form Builder That Grows With Y…7.5
• CVE-2025-11925Incorrect Content-Type header in one of the APIs (`text/html…6.1
• CVE-2025-11926The Related Posts Lite plugin for WordPress is vulnerable to…4.4
• CVE-2025-11927The Flying Images: Optimize and Lazy Load Images for Faster …4.4
• CVE-2025-11928The CSS & JavaScript Toolbox plugin for WordPress is vulnera…4.4
• CVE-2025-1193Improper host validation in the certificate validation compo…8.1