LifterLMS vulnerabilities

The LifterLMS plugin for WordPress is vulnerable to Local File Inclusion in versions up to and including 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. The llms_get_template() helper performs extract() on the shortcode attribute array before resolving the template path, allowing attacker-supplied 'template_name' and 'default_path' attributes to overwrite local parameters and control the path passed to a PHP include.

The LifterLMS plugin for WordPress up to version 10.2.1 is vulnerable to PHP Object Injection via deserialization of untrusted input. Authenticated attackers with 'edit_course' capability (e.g., instructors) can inject a PHP object, which may lead to file deletion, data theft, or code execution if a POP chain is present in another plugin or theme.

The LifterLMS WordPress plugin before version 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in. This allows any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.

The LifterLMS WordPress plugin before version 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it. This allows users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.