Alerts

Critical WordPress LMS Plugin Flaw Under Active Exploitation Enables Full Site Takeover

Zero Day Wire

— 1 min read
Critical WordPress LMS Plugin Flaw Under Active Exploitation Enables Full Site Takeover

A critical vulnerability in the Academy LMS plugin for WordPress is under active exploitation, allowing unauthenticated attackers to take over administrator accounts and gain full control of affected eLearning platforms.

The flaw, tracked as CVE-2025-15521, carries a CVSS score of 9.8 and affects all versions of the plugin up to 3.5.0. Academy LMS is widely used by educators and organizations to build and monetize online training platforms, with features including course creation, student enrollment, quizzes, and payment integration.

Exploiting Exposed Nonces

The vulnerability stems from a broken authentication mechanism in how the plugin handles password updates. Rather than properly verifying user identity through cryptographic signatures or secret keys, the plugin relies on a publicly exposed nonce that attackers can harvest from the site.

With the captured nonce, attackers can reset passwords for any account—including administrators—without authentication. This grants them full control over the WordPress installation.

Post-Exploitation Impact

Once attackers gain administrative access, the potential damage is significant:

  • Steal sensitive student and payment data
  • Inject malware or backdoors for persistent access
  • Modify course content or redirect payments
  • Use the compromised site to distribute further attacks

Active Exploitation Confirmed

Wordfence has confirmed active exploitation attempts in the wild, with attackers actively scanning for and targeting vulnerable installations. The simplicity of the attack—requiring only a harvested nonce and no authentication—makes it attractive for both opportunistic and targeted campaigns.

Remediation

Site administrators running Academy LMS should immediately update to version 3.5.1 or later. Given the active exploitation, organizations should also audit for signs of compromise, including unexpected administrator accounts, modified files, or unfamiliar plugins.

Read more

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

By Zero Day Wire
ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors

By Zero Day Wire