Executive brief
LifterLMS is a popular WordPress plugin used to create and manage online courses and quizzes. A security flaw in the plugin allows authorized users with instructor-level access to bypass security protections and run unauthorized database commands. This could allow an attacker to steal sensitive information from the website's database, potentially compromising student or administrative data.
Technical details
A SQL injection vulnerability exists in LifterLMS versions up to 9.2.1 due to insufficient escaping of the 'order' parameter and a lack of proper SQL query preparation. The flaw is located within the reporting table logic for quiz attempts. An authenticated attacker with 'Instructor' level privileges and 'edit_post' capabilities on a specific quiz can inject malicious SQL fragments into existing queries. This enables the extraction of sensitive data from the WordPress database. The issue has been addressed in subsequent updates via improved parameter sanitization and query preparation.
Affected products
- LifterLMS LifterLMS Up to, and including, 9.2.1
Timeline
- 2026-04-11: advisory: Initial disclosure by Wordfence and NVD
References
- https://plugins.trac.wordpress.org/browser/lifterlms/trunk/includes/admin/reporting/tables/llms.table.quiz.non.attempts.php
- https://plugins.trac.wordpress.org/browser/lifterlms/trunk/includes/admin/reporting/tables/llms.table.quiz.non.attempts.php
- https://plugins.trac.wordpress.org/browser/lifterlms/trunk/includes/class.llms.ajax.handler.php
- https://plugins.trac.wordpress.org/changeset/3495818/lifterlms/trunk/includes/admin/reporting/tables/llms.table.quiz.non.attempts.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/43d31d1e-0f4f-4f51-8274-650151642d03?source=cve