CVE-2026-12153: WP Learn Manager <= 1.1.8 - Unauthenticated Plugin Installation and Activation

Summary

The WP Learn Manager plugin for WordPress has a security flaw that allows anyone to install and activate plugins without permission. This could lead to malicious plugins being added to your site, potentially causing harm or disrupting your operations. You should update the plugin to a version higher than 1.1.8 to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions
rabilal	wp learn manager	<= 1.1.8

Original title

The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.8. This is due to the plugin not properly verifying that a user is authoriz...

Original description

The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins from the WordPress.org repository on the vulnerable site.

mitre CVSS3.1 9.8

Vulnerability type

CWE-862 Missing Authorization