CVE-2025-15521 (CVSS 9.8): Critical Academy LMS Flaw Exploited for Admin Takeover

**Executive summary:** A critical vulnerability (CVE-2025-15521, CVSS 9.8) in the Academy LMS WordPress plugin (versions ≤ 3.5.0) permits unauthenticated attackers to reset passwords and seize administrator accounts by exploiting a publicly exposed nonce; Wordfence has observed active exploitation attempts and blocked 76 attacks in a 24‑hour period, and administrators are strongly advised to update to the patched plugin immediately.