CVE-2025-2290 is a missing authorization (CWE-862) vulnerability in the LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes WordPress plugin. The issue arises from the lack of a capability check in the delete_access_plan function and associated AJAX endpoints, allowing unauthenticated attackers to change the status of published posts to "Trash." This affects all versions up to and including 8.0.1. The vulnerability enables denial of service against published content by limiting its availability. The CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is low.

An unauthenticated attacker can trash published posts on a vulnerable LifterLMS WordPress site, effectively removing content availability. This impacts the integrity of the website's content but does not affect confidentiality or availability directly. There is no indication of data disclosure or system compromise. The attack requires no privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to AJAX endpoints related to delete_access_plan via web application firewall rules or other access controls to prevent unauthenticated requests. Monitor plugin updates from the vendor and apply official patches promptly once available.