CVE-2026-14231
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The LifterLMS WordPress plugin before version 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in. This allows any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.
Risk Assessment
Users with low privileges can access sensitive data like coupon code titles, potentially leading to financial abuse or pricing policy violations.
Recommendation
Update the LifterLMS plugin to version 10.0.10 or later, which includes proper capability checks.
Other vulnerabilities in LifterLMS
See all- CVE-2026-104723High
The LifterLMS plugin for WordPress up to version 10.2.1 is vulnerable to PHP Object Injection via deserialization of untrusted input. Authenticated attackers with 'edit_course' capability (e.g., instructors) can inject a PHP object, which may lead to file deletion, data theft, or code execution if a POP chain is present in another plugin or theme.
- CVE-2026-14207Medium
The LifterLMS WordPress plugin before version 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it. This allows users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.
Original NVD description (English source)
The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS