LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes

LifterLMS before 10.0.10 exposes the select2_query_posts AJAX action to any logged-in user who supplies the front-end llms.ajax_nonce as _ajax_nonce. Because the handler does not require a privileged capability, a Subscriber can control post_type and post_statuses and enumerate titles from internal LifterLMS post types. For llms_coupon, the coupon code is stored as the post title, so the response directly discloses usable discount codes; other queryable types include llms_voucher, llms_order and llms_access_plan.

LifterLMS versions 9.2.3 through 10.0.9 permit an Instructor or another role able to edit courses to place event-handler attributes in Course Options > Featured Pricing Information. The attacker-controlled markup is stored in the _llms_featured_pricing post meta without removing handlers such as onclick, then rendered unescaped in the course editor and on the public course catalog. The script can therefore execute in an Administrator's wp-admin session when the administrator views and interacts with the affected course, as well as in public visitors' sessions. Version 10.0.10 adds sanitization to the pricing-display markup.

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 9.2.1.

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated WordPress account. A successful request can grant permissions or access that the caller should not possess.

LifterLMS is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

LifterLMS is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes is affected by SQL injection. Exploitation requires an authenticated administrator account. A successful request can alter database queries and expose or modify WordPress data.

LifterLMS – WordPress LMS Plugin for eLearning is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data.

LifterLMS is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

LifterLMS – WordPress LMS Plugin for eLearning is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

LifterLMS – WordPress LMS Plugin for eLearning is affected by filesystem traversal. Exploitation requires an authenticated administrator account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

LifterLMS PayPal is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for is affected by broken access control. Exposure depends on how the affected operation is made reachable by the site. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.

'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Lifterlms is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Lifterlms is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.