CVE-2025-13542

DesignThemes LMS <= 1.0.4 - Unauthenticated Privilege Escalation

Published Dec 2, 2025 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.4. This is due to the 'dtlms_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.

Analysis

Technical impact

The DesignThemes LMS plugin for WordPress allows any visitor to register a new account using the 'dtlms_register_user_front_end' function. Because this function does not limit the role that can be assigned at registration, an attacker can submit a request with the role value set to 'administrator' and receive an administrator account. Obtaining direct administrator access enables modification of site settings, content, and user data with full control.

Affected Systems

DesignThemes LMS plugin version 1.0.4 and all earlier releases on WordPress sites such as the eGrad Education theme from ThemeForest are affected.

Risk and Exploitability

The vulnerability carries a CVSS base score of 9.8, indicating critical severity, but the EPSS score of less than 1% suggests that exploitation likelihood is currently low. The absence of this issue from the CISA KEV catalog means no known public exploits are documented. Attackers would need only an unauthenticated web request to the registration endpoint, making the entry point trivial and universally reachable.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

DesignThemes

DesignThemes LMS

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.0.4

No data.

Vendor	Product	Versions
Designthemes	Designthemes Lms	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update DesignThemes LMS to a version newer than 1.0.4 which removes the unrestricted role assignment during registration.
If an update cannot be applied immediately, configure WordPress to enforce role restrictions on registration by adding a role whitelist or disabling public user registration in the plugin settings.
As a temporary measure, block or limit the 'dtlms_register_user_front_end' endpoint using a web‑application firewall or by adding a nonce requirement to the form submission process to prevent unauthenticated role injections.

Generated by OpenCVE AI on April 21, 2026 at 01:11 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.399% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://themeforest.net/item/egrad-education-wordpress-theme/42803015
https://www.wordfence.com/threat-intel/vulnerabilities/id/c880470f-3f81-47a2-b450-7074410e9f43?source=cve

History

Dec 4, 2025 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Designthemes Designthemes designthemes Lms Wordpress Wordpress wordpress
Vendors & Products		Designthemes Designthemes designthemes Lms Wordpress Wordpress wordpress

Dec 2, 2025 8:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Dec 2, 2025 7:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.4. This is due to the 'dtlms_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
Title		DesignThemes LMS <= 1.0.4 - Unauthenticated Privilege Escalation
Weaknesses		CWE-269
References		https://themeforest.net/item/egrad-education-wordpress-theme/42803015 https://www.wordfence.com/threat-intel/vulnerabilities/id/c880470f-3f81-47a2-b450-7074410e9f43?source=cve
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`