Critical WordPress Plugin Vulnerabilities Enable Account Takeover and Privilege Escalation

Multiple high-severity vulnerabilities were disclosed across popular WordPress plugins, creating pathways to account takeover, privilege escalation, and sensitive data exposure. The most severe issue, CVE-2025-15521 in Academy LMS (<= 3.5.0), allows unauthenticated administrator account takeover because the plugin’s password update flow relies on a publicly exposed WordPress nonce as authorization rather than validating user identity; Wordfence reported observing exploitation attempts in the wild and blocking dozens of attacks in a 24-hour period.

Additional disclosures affect other plugins with different exploitation prerequisites and impacts. CVE-2026-0726 in Nexter Extension – Site Enhancements Toolkit (<= 4.4.6) is an unauthenticated PHP object injection via nxt_unserialize_replace, but it requires a usable POP chain from another installed plugin/theme to reach file deletion, data theft, or code execution. CVE-2025-15347 in Creator LMS (<= 1.1.12) enables authenticated (Contributor+) attackers to update arbitrary WordPress options due to a missing capability check, potentially leading to privilege escalation or site compromise. CVE-2025-14977 in Dokan (<= 4.2.4) is an IDOR in the /wp-json/dokan/v1/settings REST endpoint that lets authenticated (Customer+) users read/modify other vendors’ settings, including changing PayPal payout emails and accessing bank/payment details, enabling fraud and sensitive information disclosure.