High severity8.8NVD Advisory· Published Jul 19, 2025· Updated Jun 17, 2026
CVE-2015-10139
CVE-2015-10139
Description
The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wp_ajax_import_data' AJAX action. This makes it possible for authenticated attackers to change otherwise restricted settings and potentially create a new accessible admin account.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:vibethemes:wordpress_learning_management_system_:*:*:*:*:*:wordpress:*:*+ 1 more
- cpe:2.3:a:vibethemes:wordpress_learning_management_system_:*:*:*:*:*:wordpress:*:*range: >=1.5.2,<1.8.9
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
6- packetstormsecurity.com/files/130291/nvdExploitThird Party Advisory
- www.rapid7.com/db/modules/auxiliary/admin/http/wp_wplms_privilege_escalation/nvdThird Party Advisory
- www.wordfence.com/threat-intel/vulnerabilities/id/6e0e8f5f-8216-4276-a810-860f9b52c447nvdThird Party Advisory
- themeforest.net/item/wplms-learning-management-system/6780226nvdProduct
- twitter.com/_wpscan_/status/564874637679820800nvdBroken Link
- wpscan.com/vulnerability/7785nvdBroken Link
News mentions
0No linked articles in our index yet.