← Vulnerability feed

Vulnerability record · CVE-2025-49925 · published 22 October 2025

CVE-2025-49925: Vibethemes wordpress learning management system missing authorization vulnerability

Vibethemes · Wordpress Learning Management System

Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.7.

7.5 CVSS 3.1 High EPSS 0.37% · top 72.2% CWE-862 · Missing authorization
7.5CVSS 3.1 base score
0.37%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.7.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://patchstack.com/database/Wordpress/Plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-7-broken-access

Track CVE-2025-49925 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-58668Vibethemes wordpress learning management system missing authorization vulnerabilityMissing Authorization vulnerability in VibeThemes WPLMS wplms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe…EPSS 0.28%9.8CVE-2024-56043Vibethemes wordpress learning management system vulnerabilityIncorrect Privilege Assignment vulnerability in VibeThemes WPLMS wplms_plugin allows Privilege Escalation.This issue affects WPLMS: from n/a through …EPSS 0.63%9.8CVE-2024-56044Vibethemes wordpress learning management system authentication bypass via alternate path vulnerabilityAuthentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplms_plugin allows Authentication Bypass.This issue affec…EPSS 0.81%9.8CVE-2024-56042Vibethemes wordpress learning management system sql injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Inject…EPSS 0.70%9.8CVE-2024-56046Vibethemes wordpress learning management system unrestricted file upload vulnerabilityUnrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue a…EPSS 0.76%9.8CVE-2024-10470Vibethemes wordpress learning management system path traversal vulnerabilityThe WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insuff…EPSS 35%9.3CVE-2024-56045Vibethemes wordpress learning management system vulnerabilityPath Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.EPSS 0.68%8.8CVE-2024-56053Vibethemes wordpress learning management system sql injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Inject…EPSS 0.44%

Source: NIST National Vulnerability Database (record CVE-2025-49925), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.