Is CVE-2026-104723 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104723 being exploited in the wild.

How severe is CVE-2026-104723?

High severity, with a CVSS score of 8.8, published 10 October 2026.

Which products and versions are affected?

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes up to and including 10.2.1.

Is there a fix for CVE-2026-104723?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-104723 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-104723?

Check whether you run LifterLMS – WP LMS for eLearning, Online Courses or & Quizzes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104723: LifterLMS plugin PHP Object Injection vulnerability

CVE-2026-104723 · Severity: high · CVSS 8.8 · Published 2026-10-10

The LifterLMS WordPress plugin, used to create and manage online courses and learning content, contains a PHP Object Injection flaw that allows authenticated course instructors and administrators to inject malicious code. While the plugin itself does not provide a direct attack path, the vulnerability becomes dangerous when combined with vulnerable third-party plugins or themes installed on the same WordPress site, potentially enabling attackers to delete files, steal data, or execute arbitrary code. Exploitation requires the attacker to hold instructor-level or higher permissions and occurs during lesson creation.

Vendors: LifterLMS.

Quick answers

Is CVE-2026-104723 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104723 being exploited in the wild.
How severe is CVE-2026-104723?: High severity, with a CVSS score of 8.8, published 10 October 2026.
Which products and versions are affected?: LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes up to and including 10.2.1.
Is there a fix for CVE-2026-104723?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-104723 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-104723?: Check whether you run LifterLMS – WP LMS for eLearning, Online Courses or & Quizzes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

PHP Object Injection via unsafe deserialization of untrusted input in the LifterLMS plugin affecting all versions up to 10.2.1. The vulnerability is triggered during lesson creation when a temporary lesson ID is used, accessible to authenticated users with edit_course capability (Instructor, Instructor's Assistant, LMS Manager, Administrator). Exploitation depends on the presence of a POP (Property-Oriented Programming) chain in another installed plugin or theme; without such a chain, the vulnerability has no practical impact but may enable arbitrary file deletion, data exfiltration, or remote code execution.

Affected products

LifterLMS LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes up to and including 10.2.1

Timeline

2026-10-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.