Executive brief
LifterLMS, a popular learning management system plugin for WordPress, contains a security flaw that allows any registered user (such as a student or subscriber) to view sensitive internal information. Specifically, an attacker can access the titles of private records, including active coupon codes and voucher details, which are normally restricted to administrators. This could lead to unauthorized discounts being used or the exposure of internal business data, potentially impacting revenue and operational privacy.
Technical details
The vulnerability exists in the `select2_query_posts` AJAX handler within the LifterLMS plugin. The handler only verifies that a user is logged in and provides a valid AJAX nonce (which is available to all logged-in users on the front-end) but fails to implement a `current_user_can()` capability check. By sending a crafted POST request to `admin-ajax.php` with a specific `post_type` parameter (e.g., `llms_coupon`, `llms_voucher`, or `llms_order`), an authenticated attacker with Subscriber-level privileges can retrieve the titles of these internal post types. This results in the disclosure of sensitive strings like discount codes. The issue is fixed in version 10.0.10.
Affected products
- LifterLMS LifterLMS < 10.0.10
Timeline
- 2026-07-10: disclosed: Publicly published by WPScan
- 2026-07-10: patched: Fixed in version 10.0.10
- 2026-07-30: advisory: NVD publication date