External risk intelligence

WP Learn Manager Authorization Bypass Allows Arbitrary Plugin Installation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-12153

The vulnerability exists in a WordPress plugin. WordPress sites are typically deployed as public-facing web applications, and this plugin functionality is reachable via standard web requests, making it a common target for external network-based interaction.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects the WP Learn Manager plugin for WordPress, allowing unauthenticated attackers to potentially install any plugin from the WordPress.org repository. This could compromise the integrity and security of affected websites. The main concern is confirming relevance and exposure for this plugin.

Unauthorized plugin installation on websites.
Impacts WordPress sites; assess plugin usage.
Verify if WP Learn Manager is used.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending network requests to a vulnerable WordPress site. The WP Learn Manager plugin fails to properly check user authorization, allowing attackers to install and activate any plugin from the WordPress.org repository.

No authentication required.
Unauthorized plugin installation triggered.
Full site compromise risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to install and activate any plugin from the WordPress.org repository on a vulnerable site. This could lead to the installation of malicious plugins, altering site functionality, or compromising sensitive data.

WordPress site plugins and data.
Unauthenticated users can trigger actions.
Malicious plugins could be installed.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership for this vulnerability likely falls to the website owner or administrator responsible for the WordPress site, potentially supported by the platform or infrastructure team managing the hosting environment. The first critical step is to identify all WordPress sites utilizing the affected plugin, assess their exposure to the internet, and confirm business criticality before planning remediation.

Site administrators own this issue.
Verify plugin use and site exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WP Learn Manager plugin?

WP Learn Manager is an add-on for WordPress websites, commonly used to build and manage educational content, online courses, and learning management systems. It extends the core capabilities of a WordPress site by introducing specialized tools for instructors and students to interact with curriculum materials.

What does authorization bypass mean for CVE-2026-12153?

This vulnerability is classified as CWE-862, which is a Missing Authorization flaw. In plain terms, the plugin fails to check if a person has the necessary permissions before running a sensitive command. Because of this oversight, the software treats an unauthenticated visitor as if they were a site administrator, allowing them to perform restricted actions that they should never be able to access.

How can an attacker trigger this vulnerability?

An attacker exploits this by sending specific network requests to the site that target the plugin's insecure functions. Because the plugin does not verify user identity, no login or administrative credentials are required to initiate the attack. Note that simply visiting the site or browsing normal pages will not trigger this; the malicious action requires sending a targeted request that instructs the plugin to install a new extension from the WordPress repository.

Is my site at risk if it runs WP Learn Manager?

According to Halo Surface Signal, this vulnerability is highly relevant because WordPress plugins are inherently designed to be reachable via standard web requests. If your WordPress site is exposed to the internet, these requests can originate from any external source. Sites that are internal-only may face a lower risk, but any public-facing installation using this plugin is a potential target for unauthorized plugin installation.

What should I do if I use this plugin?

Your first step is to perform an inventory of your WordPress environment to confirm if WP Learn Manager is installed. If you find the plugin, assess its importance to your operations and check the site's internet accessibility. Consult the official WordPress plugin repository or the vendor's site for the most recent version, as applying the latest update is the primary method to resolve the authorization failure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.