Search criteria
8 vulnerabilities found for LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes by chrisbadgett
CVE-2025-11923 (GCVE-0-2025-11923)
Vulnerability from cvelistv5 – Published: 2025-11-13 03:27 – Updated: 2025-11-13 14:34
VLAI?
Title
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes - Various Versions - Authenticated (Student+) Privilege Escalation
Summary
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not properly validating a user's identity prior to allowing them to modify their own role via the REST API. The permission check in the update_item_permissions_check() function returns true when a user updates their own account without verifying the role changes. This makes it possible for authenticated attackers, with student-level access and above, to escalate their privileges to administrator by updating their own roles array via a crafted REST API request. Another endpoint intended for instructors also provides an attack vector. Affected version ranges are 3.5.3-3.41.2, 4.0.0-4.21.3, 5.0.0-5.10.0, 6.0.0-6.11.0, 7.0.0-7.8.7, 8.0.0-8.0.7, 9.0.0-9.0.7, 9.1.0.
Severity ?
8.8 (High)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| chrisbadgett | LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes |
Affected:
3.5.3 , ≤ 3.41.1
(semver)
Affected: 4.0.0 , ≤ 4.21.3 (semver) Affected: 5.0.0 , ≤ 5.10.0 (semver) Affected: 6.0.0 , ≤ 6.11.0 (semver) Affected: 7.0.0 , ≤ 7.8.7 (semver) Affected: 8.0.0 , ≤ 8.0.7 (semver) Affected: 9.0.0 , ≤ 9.0.7 (semver) Affected: 9.1.0 |
Credits
Angus Girvan
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11923",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-13T14:27:06.422104Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-13T14:34:06.521Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes",
"vendor": "chrisbadgett",
"versions": [
{
"lessThanOrEqual": "3.41.1",
"status": "affected",
"version": "3.5.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.21.3",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.0",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.0",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.8.7",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.0.7",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.0.7",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "9.1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Angus Girvan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not properly validating a user\u0027s identity prior to allowing them to modify their own role via the REST API. The permission check in the update_item_permissions_check() function returns true when a user updates their own account without verifying the role changes. This makes it possible for authenticated attackers, with student-level access and above, to escalate their privileges to administrator by updating their own roles array via a crafted REST API request. Another endpoint intended for instructors also provides an attack vector. Affected version ranges are 3.5.3-3.41.2, 4.0.0-4.21.3, 5.0.0-5.10.0, 6.0.0-6.11.0, 7.0.0-7.8.7, 8.0.0-8.0.7, 9.0.0-9.0.7, 9.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-13T03:27:39.431Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cc13d13c-6b79-4bf1-8e77-c8cb836dc0c5?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/lifterlms/trunk/libraries/lifterlms-rest/includes/server/class-llms-rest-students-controller.php#L386"
},
{
"url": "https://plugins.trac.wordpress.org/browser/lifterlms/trunk/libraries/lifterlms-rest/includes/abstracts/class-llms-rest-users-controller.php#L721"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3393703%40lifterlms%2Ftrunk\u0026old=3388956%40lifterlms%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2025-11-03T20:49:36.000+00:00",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2025-11-12T14:27:17.000+00:00",
"value": "Disclosed"
}
],
"title": "LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes - Various Versions - Authenticated (Student+) Privilege Escalation"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-11923",
"datePublished": "2025-11-13T03:27:39.431Z",
"dateReserved": "2025-10-17T18:50:39.481Z",
"dateUpdated": "2025-11-13T14:34:06.521Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-2290 (GCVE-0-2025-2290)
Vulnerability from cvelistv5 – Published: 2025-03-19 04:21 – Updated: 2025-03-19 14:03
VLAI?
Title
LifterLMS <= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing
Summary
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to "Trash" for every published post, therefore limiting the availability of the website's content.
Severity ?
5.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| chrisbadgett | LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes |
Affected:
* , ≤ 8.0.1
(semver)
|
Credits
Michael Mazzolini
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2290",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-19T14:03:24.818201Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-19T14:03:46.870Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes",
"vendor": "chrisbadgett",
"versions": [
{
"lessThanOrEqual": "8.0.1",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Mazzolini"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to \"Trash\" for every published post, therefore limiting the availability of the website\u0027s content."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-19T04:21:05.815Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4f64dbf2-b75a-4a35-9b4e-413b8fd1fff0?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3257328/lifterlms/trunk/includes/class.llms.ajax.handler.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-03-13T00:00:00.000+00:00",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2025-03-18T00:00:00.000+00:00",
"value": "Disclosed"
}
],
"title": "LifterLMS \u003c= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-2290",
"datePublished": "2025-03-19T04:21:05.815Z",
"dateReserved": "2025-03-13T16:43:28.074Z",
"dateUpdated": "2025-03-19T14:03:46.870Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12596 (GCVE-0-2024-12596)
Vulnerability from cvelistv5 – Published: 2024-12-18 03:22 – Updated: 2024-12-18 16:34
VLAI?
Title
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes <= 7.8.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
Summary
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check on the 'llms_delete_cert' action in all versions up to, and including, 7.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.
Severity ?
4.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| chrisbadgett | LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes |
Affected:
* , ≤ 7.8.5
(semver)
|
Credits
Lucio Sá
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12596",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-18T16:24:10.882034Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-18T16:34:43.867Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes",
"vendor": "chrisbadgett",
"versions": [
{
"lessThanOrEqual": "7.8.5",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lucio S\u00e1"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check on the \u0027llms_delete_cert\u0027 action in all versions up to, and including, 7.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-18T03:22:06.256Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e75a03b-7552-4228-a4d0-13c78d20f6d5?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3208662/lifterlms/trunk/includes/controllers/class.llms.controller.certificates.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3208662/lifterlms/trunk/includes/abstracts/llms-abstract-controller-user-engagements.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-12-17T14:26:20.000+00:00",
"value": "Disclosed"
}
],
"title": "LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes \u003c= 7.8.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-12596",
"datePublished": "2024-12-18T03:22:06.256Z",
"dateReserved": "2024-12-12T22:14:08.110Z",
"dateUpdated": "2024-12-18T16:34:43.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-7349 (GCVE-0-2024-7349)
Vulnerability from cvelistv5 – Published: 2024-09-06 06:50 – Updated: 2024-09-06 13:34
VLAI?
Title
LifterLMS <= 7.7.5 - Authenticated (Admin+) SQL Injection
Summary
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the 'order' parameter in all versions up to, and including, 7.7.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity ?
7.2 (High)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| chrisbadgett | LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes |
Affected:
* , ≤ 7.7.5
(semver)
|
Credits
Furkan K.
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:lifterlms:lifterlms:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "lifterlms",
"vendor": "lifterlms",
"versions": [
{
"lessThanOrEqual": "7.7.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7349",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-06T13:32:46.228794Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T13:34:03.168Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes",
"vendor": "chrisbadgett",
"versions": [
{
"lessThanOrEqual": "7.7.5",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Furkan K."
}
],
"descriptions": [
{
"lang": "en",
"value": "The LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the \u0027order\u0027 parameter in all versions up to, and including, 7.7.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T06:50:50.814Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3a096506-b18e-419c-808b-6099baa628ce?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3139798/lifterlms/tags/7.7.6/includes/abstracts/abstract.llms.database.query.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-09-05T00:00:00.000+00:00",
"value": "Disclosed"
}
],
"title": "LifterLMS \u003c= 7.7.5 - Authenticated (Admin+) SQL Injection"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-7349",
"datePublished": "2024-09-06T06:50:50.814Z",
"dateReserved": "2024-07-31T20:16:40.340Z",
"dateUpdated": "2024-09-06T13:34:03.168Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-11923 (GCVE-0-2025-11923)
Vulnerability from nvd – Published: 2025-11-13 03:27 – Updated: 2025-11-13 14:34
VLAI?
Title
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes - Various Versions - Authenticated (Student+) Privilege Escalation
Summary
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not properly validating a user's identity prior to allowing them to modify their own role via the REST API. The permission check in the update_item_permissions_check() function returns true when a user updates their own account without verifying the role changes. This makes it possible for authenticated attackers, with student-level access and above, to escalate their privileges to administrator by updating their own roles array via a crafted REST API request. Another endpoint intended for instructors also provides an attack vector. Affected version ranges are 3.5.3-3.41.2, 4.0.0-4.21.3, 5.0.0-5.10.0, 6.0.0-6.11.0, 7.0.0-7.8.7, 8.0.0-8.0.7, 9.0.0-9.0.7, 9.1.0.
Severity ?
8.8 (High)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| chrisbadgett | LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes |
Affected:
3.5.3 , ≤ 3.41.1
(semver)
Affected: 4.0.0 , ≤ 4.21.3 (semver) Affected: 5.0.0 , ≤ 5.10.0 (semver) Affected: 6.0.0 , ≤ 6.11.0 (semver) Affected: 7.0.0 , ≤ 7.8.7 (semver) Affected: 8.0.0 , ≤ 8.0.7 (semver) Affected: 9.0.0 , ≤ 9.0.7 (semver) Affected: 9.1.0 |
Credits
Angus Girvan
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11923",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-13T14:27:06.422104Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-13T14:34:06.521Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes",
"vendor": "chrisbadgett",
"versions": [
{
"lessThanOrEqual": "3.41.1",
"status": "affected",
"version": "3.5.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.21.3",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.0",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.0",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.8.7",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.0.7",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.0.7",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "9.1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Angus Girvan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not properly validating a user\u0027s identity prior to allowing them to modify their own role via the REST API. The permission check in the update_item_permissions_check() function returns true when a user updates their own account without verifying the role changes. This makes it possible for authenticated attackers, with student-level access and above, to escalate their privileges to administrator by updating their own roles array via a crafted REST API request. Another endpoint intended for instructors also provides an attack vector. Affected version ranges are 3.5.3-3.41.2, 4.0.0-4.21.3, 5.0.0-5.10.0, 6.0.0-6.11.0, 7.0.0-7.8.7, 8.0.0-8.0.7, 9.0.0-9.0.7, 9.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-13T03:27:39.431Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cc13d13c-6b79-4bf1-8e77-c8cb836dc0c5?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/lifterlms/trunk/libraries/lifterlms-rest/includes/server/class-llms-rest-students-controller.php#L386"
},
{
"url": "https://plugins.trac.wordpress.org/browser/lifterlms/trunk/libraries/lifterlms-rest/includes/abstracts/class-llms-rest-users-controller.php#L721"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3393703%40lifterlms%2Ftrunk\u0026old=3388956%40lifterlms%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2025-11-03T20:49:36.000+00:00",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2025-11-12T14:27:17.000+00:00",
"value": "Disclosed"
}
],
"title": "LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes - Various Versions - Authenticated (Student+) Privilege Escalation"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-11923",
"datePublished": "2025-11-13T03:27:39.431Z",
"dateReserved": "2025-10-17T18:50:39.481Z",
"dateUpdated": "2025-11-13T14:34:06.521Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-2290 (GCVE-0-2025-2290)
Vulnerability from nvd – Published: 2025-03-19 04:21 – Updated: 2025-03-19 14:03
VLAI?
Title
LifterLMS <= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing
Summary
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to "Trash" for every published post, therefore limiting the availability of the website's content.
Severity ?
5.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| chrisbadgett | LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes |
Affected:
* , ≤ 8.0.1
(semver)
|
Credits
Michael Mazzolini
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2290",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-19T14:03:24.818201Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-19T14:03:46.870Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes",
"vendor": "chrisbadgett",
"versions": [
{
"lessThanOrEqual": "8.0.1",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Mazzolini"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to \"Trash\" for every published post, therefore limiting the availability of the website\u0027s content."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-19T04:21:05.815Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4f64dbf2-b75a-4a35-9b4e-413b8fd1fff0?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3257328/lifterlms/trunk/includes/class.llms.ajax.handler.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-03-13T00:00:00.000+00:00",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2025-03-18T00:00:00.000+00:00",
"value": "Disclosed"
}
],
"title": "LifterLMS \u003c= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-2290",
"datePublished": "2025-03-19T04:21:05.815Z",
"dateReserved": "2025-03-13T16:43:28.074Z",
"dateUpdated": "2025-03-19T14:03:46.870Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12596 (GCVE-0-2024-12596)
Vulnerability from nvd – Published: 2024-12-18 03:22 – Updated: 2024-12-18 16:34
VLAI?
Title
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes <= 7.8.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
Summary
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check on the 'llms_delete_cert' action in all versions up to, and including, 7.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.
Severity ?
4.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| chrisbadgett | LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes |
Affected:
* , ≤ 7.8.5
(semver)
|
Credits
Lucio Sá
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12596",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-18T16:24:10.882034Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-18T16:34:43.867Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes",
"vendor": "chrisbadgett",
"versions": [
{
"lessThanOrEqual": "7.8.5",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lucio S\u00e1"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check on the \u0027llms_delete_cert\u0027 action in all versions up to, and including, 7.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-18T03:22:06.256Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e75a03b-7552-4228-a4d0-13c78d20f6d5?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3208662/lifterlms/trunk/includes/controllers/class.llms.controller.certificates.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3208662/lifterlms/trunk/includes/abstracts/llms-abstract-controller-user-engagements.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-12-17T14:26:20.000+00:00",
"value": "Disclosed"
}
],
"title": "LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes \u003c= 7.8.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-12596",
"datePublished": "2024-12-18T03:22:06.256Z",
"dateReserved": "2024-12-12T22:14:08.110Z",
"dateUpdated": "2024-12-18T16:34:43.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-7349 (GCVE-0-2024-7349)
Vulnerability from nvd – Published: 2024-09-06 06:50 – Updated: 2024-09-06 13:34
VLAI?
Title
LifterLMS <= 7.7.5 - Authenticated (Admin+) SQL Injection
Summary
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the 'order' parameter in all versions up to, and including, 7.7.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity ?
7.2 (High)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| chrisbadgett | LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes |
Affected:
* , ≤ 7.7.5
(semver)
|
Credits
Furkan K.
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:lifterlms:lifterlms:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "lifterlms",
"vendor": "lifterlms",
"versions": [
{
"lessThanOrEqual": "7.7.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7349",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-06T13:32:46.228794Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T13:34:03.168Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes",
"vendor": "chrisbadgett",
"versions": [
{
"lessThanOrEqual": "7.7.5",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Furkan K."
}
],
"descriptions": [
{
"lang": "en",
"value": "The LifterLMS \u2013 WP LMS for eLearning, Online Courses, \u0026 Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the \u0027order\u0027 parameter in all versions up to, and including, 7.7.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T06:50:50.814Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3a096506-b18e-419c-808b-6099baa628ce?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3139798/lifterlms/tags/7.7.6/includes/abstracts/abstract.llms.database.query.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-09-05T00:00:00.000+00:00",
"value": "Disclosed"
}
],
"title": "LifterLMS \u003c= 7.7.5 - Authenticated (Admin+) SQL Injection"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-7349",
"datePublished": "2024-09-06T06:50:50.814Z",
"dateReserved": "2024-07-31T20:16:40.340Z",
"dateUpdated": "2024-09-06T13:34:03.168Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}