The WP Learn Manager plugin for WordPress is vulnerable to an authorization bypass that allows unauthenticated attackers to install and activate arbitrary plugins from the WordPress.org repository. This flaw stems from the plugin failing to verify that the user is authorized to perform the installation action, a weakness that maps to CWE-862. When exploited, the attacker can effectively run arbitrary code on the server by enabling a malicious plugin, potentially compromising the entire site and its data.

All instances of the WP Learn Manager plugin developed by rabilal, with affected versions up to and including 1.1.8. Users with sites running any of these plugin versions before the mitigated release are at risk.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score is < 1%, indicating a low probability of exploitation, but the lack of listed exploitation in the KEV catalog does not diminish the immediate risk because the flaw permits direct remote code execution via the publicly reachable AJAX endpoint. The likely attack vector involves an unauthenticated HTTP request to the jslearnmanager_ajax Ajax action, which the plugin accepts without sufficient authorization checks. Given the low barrier to exploitation, administrators should treat this as a high priority threat.