Academy LMS Privilege Escalation Vulnerability via Social Login Addon

A privilege escalation vulnerability has been identified in the Academy LMS WordPress plugin, affecting all versions through 3.3.7. The issue arises because the plugin fails to properly validate user roles before registering users through the Social Login addon. This flaw allows unauthenticated attackers to change their role to Administrator during the registration process.

Impact

Exploitation of this vulnerability allows unauthenticated users to gain Administrator privileges on the WordPress site.

Remediation

Users can update to version 3.3.8 or a newer patched version to address this vulnerability.