CVE-2026-110284
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
The LifterLMS plugin for WordPress is vulnerable to Local File Inclusion in versions up to and including 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. The llms_get_template() helper performs extract() on the shortcode attribute array before resolving the template path, allowing attacker-supplied 'template_name' and 'default_path' attributes to overwrite local parameters and control the path passed to a PHP include.
Risk Assessment
An authenticated attacker with Instructor-level access or above can include and execute arbitrary files on the server, bypass access controls, obtain sensitive data, or achieve code execution.
Recommendation
Update the LifterLMS plugin to a version newer than 10.3.1. Restrict Instructor privileges and verify user file upload capabilities.
Other vulnerabilities in LifterLMS
See all- CVE-2026-104723High
The LifterLMS plugin for WordPress up to version 10.2.1 is vulnerable to PHP Object Injection via deserialization of untrusted input. Authenticated attackers with 'edit_course' capability (e.g., instructors) can inject a PHP object, which may lead to file deletion, data theft, or code execution if a POP chain is present in another plugin or theme.
- CVE-2026-14231Medium
The LifterLMS WordPress plugin before version 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in. This allows any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.
- CVE-2026-14207Medium
The LifterLMS WordPress plugin before version 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it. This allows users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.
Original NVD description (English source)
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing extract() on the shortcode attribute array before resolving the template path, which allows the attacker-supplied 'template_name' and 'default_path' shortcode attributes to overwrite the function's local parameters and ultimately control the path passed to a PHP include. This makes it possible for authenticated attackers, with Instructor-level access and above, to include and execute arbitrary files on the server, that can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with safe extensions containing attacker-controlled content can be uploaded and included.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS