Skip to content
Sign in
4.3 Medium

CVE-2026-14231 The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX…

Description

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.

Affected products and versions

Product Affected versions Fixed in
LifterLMS 10.0 earliest → < 10.0.10 10.0.10

Other CVEs of LifterLMS

The 3 CVEs of LifterLMS →
CVE-2026-14207 The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field… 6.1 Medium CVE-2024-13619 The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the… 6.1 Medium
Track this CVE