CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.4. This is due to the 'dtlms_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
Explanation of Vulnerability in Simple Terms
DesignThemes LMS versions 1.0.4 and earlier contain a privilege management flaw that allows unauthenticated attackers to gain full control over the system. An attacker can read sensitive data, modify content, and disrupt service without needing valid credentials or user interaction. This affects all installations of the affected versions.
What an attacker can do
Read all data, modify any content, and disable the site without authentication.
Potential impact on your site
Complete compromise of the LMS: attackers can access student data, alter courses, and take the site offline.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
