CVE-2025-14156
Published: 15 December 2025
Summary
CVE-2025-14156 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 41.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-14156 is a privilege escalation vulnerability affecting the Fox LMS – WordPress LMS Plugin for WordPress in all versions up to and including 1.0.5.1. The issue stems from improper validation of the 'role' parameter during user creation via the /fox-lms/v1/payments/create-order REST API endpoint, classified under CWE-20 (Improper Input Validation). It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By sending a crafted request to the vulnerable endpoint, they can create new WordPress user accounts assigned arbitrary roles, such as administrator, granting full control over the site and enabling complete compromise.
Advisories reference a code changeset in the plugin's Payments.php file between versions 1.0.5.0 and 1.0.5.2, suggesting validation fixes were introduced in 1.0.5.2. The Wordfence threat intelligence page provides further details on the vulnerability (ID: de4f8d45-9522-4a32-bc98-be8dbf3a5cf1). Security practitioners should update to Fox LMS version 1.0.5.2 or later and review access to the REST API endpoint.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-203362
Vulnerability details
The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via…
more
the `/fox-lms/v1/payments/create-order` REST API endpoint. This makes it possible for unauthenticated attackers to create new user accounts with arbitrary roles, including administrator, leading to complete site compromise.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote exploitation of a public-facing WordPress REST API (T1190) to create arbitrary user accounts with administrator roles (T1136.001), granting full site control.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the improper input validation of the 'role' parameter in the /fox-lms/v1/payments/create-order REST API endpoint, preventing unauthenticated creation of administrator accounts.
Enforces logical access authorizations to block unauthenticated privilege escalation via arbitrary role assignment during user creation.
Mandates timely flaw remediation by updating the Fox LMS plugin to version 1.0.5.2 or later, which patches the validation vulnerability.