Aller au contenu
Se connecter
4.3 Moyenne

CVE-2026-14231 The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX…

Description

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.

Produits et versions touchés

Produit Versions touchées Corrigé en
LifterLMS 10.0 premières → < 10.0.10 10.0.10

Autres CVE de LifterLMS

Les 3 CVE de LifterLMS →
CVE-2026-14207 The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field… 6.1 Moyenne CVE-2024-13619 The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the… 6.1 Moyenne
Suivre cette CVE