CVE-2025-11923: The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalati

The LifterLMS WordPress plugin has a privilege escalation vulnerability (CVE-2025-11923) where the plugin fails to properly verify user identity before allowing role changes through the REST API (a standard way for programs to communicate and exchange data). This allows attackers with student-level access to promote themselves to administrator by sending a specially crafted request to modify their own role. The vulnerability affects multiple versions of the plugin ranging from 3.5.3 through 9.1.0.