CVE-2025-2290

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to "Trash" for every published post, therefore limiting the availability of the website's content.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Mar 19, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-229009.8Totolink N600R v4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macCloneMac parameter in the setWanConfig functionCVE-2025-229034.6TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the pin parameter in the function setWiFiWpsConfig.CVE-2025-229049.8RE11S v1.11 was discovered to contain a stack overflow via the pptpUserName parameter in the setWAN function.CVE-2025-229059.8RE11S v1.11 was discovered to contain a command injection vulnerability via the command parameter at /goform/mp.CVE-2025-229069.8RE11S v1.11 was discovered to contain a command injection vulnerability via the L2TPUserName parameter at /goform/setWAN.CVE-2025-229079.8RE11S v1.11 was discovered to contain a stack overflow via the selSSID parameter in the formWlSiteSurvey function.CVE-2025-22919.8Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attaCVE-2025-229115.6RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formiNICbasicREP function.CVE-2025-229129.8RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept.CVE-2025-229139.8RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formStaDrvSetup function.CVE-2025-229169.8RE11S v1.11 was discovered to contain a stack overflow via the pppUserName parameter in the formPPPoESetup function.CVE-2025-229175.4A reflected cross-site scripting (XSS) vulnerability in Audemium ERP <=0.9.0 allows remote attackers to execute an arbitrary JavaScript payl
CVE-2025-2290: Medium severity, CVSS 5.3 | Vulnix