Critical · published December 15, 2025
🚨 A crafty REST API flaw lets attackers create any user account they want, including admin! With Fox LMS versions up to 1.0.5.1, this means full access to your WordPress site is just a wrong parameter away. 🔥 Think of it like a restaurant where anyone can walk in, hand over a fake ID, and claim to be the head chef — chaos unfolds as they take charge of the kitchen! In this case, the 'role' parameter isn't properly checked, opening the door for trouble. An unauthenticated attacker could exploit this vulnerability to create an account with admin privileges, allowing them to wreak havoc on your site. This could mean deleting content, stealing sensitive data, or even taking the entire site offline — an absolutely devastating situation!
Think of it like a restaurant where anyone can walk in, hand over a fake ID, and claim to be the head chef — chaos unfolds as they take charge of the kitchen! In this case, the 'role' parameter isn't properly checked, opening the door for trouble. This privilege escalation vulnerability in Fox LMS arises from the lack of validation on the 'role' parameter during user creation through the `/fox-lms/v1/payments/create-order` API. Attackers can exploit this to create any user, including administrators, without authentication.
An unauthenticated attacker could exploit this vulnerability to create an account with admin privileges, allowing them to wreak havoc on your site. This could mean deleting content, stealing sensitive data, or even taking the entire site offline — an absolutely devastating situation! To protect your site, immediately update the Fox LMS plugin to version 1.0.5.2 or later. Additionally, review user roles in your site settings to ensure no unauthorized accounts exist. Check your access controls to bolster security! You've got this! Stay vigilant and follow these steps to secure your WordPress site! 🛡️