CVE-2024-1505: CWE-269 Improper Privilege Management in kodezen Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. This is due to plugin allowing arbitrary user meta updates through the saved_user_info() function. This makes it possible for authenticated attackers, with minimal permissions such as students, to elevate their user role to that of an administrator.
AI Analysis
Technical Summary
The Academy LMS WordPress plugin for eLearning solutions contains an improper privilege management vulnerability (CWE-269) in all versions up to and including 1.9.19. The issue arises because the plugin's saved_user_info() function permits arbitrary updates to user meta data without sufficient permission checks. As a result, authenticated users with low-level roles can escalate their privileges to administrator, gaining full control over the WordPress site. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.
Potential Impact
Successful exploitation allows an authenticated attacker with minimal permissions to escalate their privileges to administrator. This can lead to complete compromise of the WordPress site, including unauthorized access to sensitive data, site configuration changes, and potential further attacks on site users or infrastructure.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only and consider disabling or removing the plugin if possible. Monitor for updates from the vendor (kodezen) regarding patches or official fixes.
CVE-2024-1505: CWE-269 Improper Privilege Management in kodezen Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
Description
The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. This is due to plugin allowing arbitrary user meta updates through the saved_user_info() function. This makes it possible for authenticated attackers, with minimal permissions such as students, to elevate their user role to that of an administrator.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Academy LMS WordPress plugin for eLearning solutions contains an improper privilege management vulnerability (CWE-269) in all versions up to and including 1.9.19. The issue arises because the plugin's saved_user_info() function permits arbitrary updates to user meta data without sufficient permission checks. As a result, authenticated users with low-level roles can escalate their privileges to administrator, gaining full control over the WordPress site. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.
Potential Impact
Successful exploitation allows an authenticated attacker with minimal permissions to escalate their privileges to administrator. This can lead to complete compromise of the WordPress site, including unauthorized access to sensitive data, site configuration changes, and potential further attacks on site users or infrastructure.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only and consider disabling or removing the plugin if possible. Monitor for updates from the vendor (kodezen) regarding patches or official fixes.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-02-14T18:48:20.849Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6d33b7ef31ef0b56ee88
Added to database: 2/25/2026, 9:44:19 PM
Last enriched: 4/9/2026, 7:04:13 AM
Last updated: 4/12/2026, 5:22:31 PM
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.