CVE-2025-15521 (CVSS 9.8): Critical Academy LMS Flaw Exploited for Admin Takeover

CVE-2025-15521 (CVSS 9.8) is a critical flaw in the Academy LMS plugin for WordPress that allows unauthenticated attackers to seize administrator control and effectively take over a site. The vulnerability centres on how the plugin handles password updates, relying on a publicly exposed nonce for authorization rather than proper user authentication.

Versions up to and including 3.5.0 are affected, meaning an attacker can reset passwords for any user, including Administrators, and gain full administrative access to the WordPress dashboard. Once inside, an attacker can steal data, inject malware, delete courses, or redirect payments. Wordfence has begun detecting and blocking exploitation attempts, with 76 separate attacks blocked in a single 24-hour window.

With over 2,000 active installations, site owners running the affected version are urged to update to the latest patched release to close the security hole. according to Wordfence.