CVE-2026-110284 lifterlms CVE debrief

Who should care

Defenders of WordPress installations using LifterLMS plugin version 10.3.1 or earlier, especially those with Instructor-level access or higher, should assess exposure and prioritize remediation. This includes reviewing server logs for potential exploitation attempts and applying vendor remediation when available.

Why it matters

CVE-2026-110284 is a high-severity Local File Inclusion vulnerability in the LifterLMS plugin for WordPress. Authenticated attackers with Instructor-level access can exploit this vulnerability to include and execute arbitrary files on the server, potentially leading to code execution, data breaches, or access control bypass. Defenders should prioritize assessing exposure, verifying server logs for exploitation attempts, and applying vendor remediation when available.

• Potential code execution in cases where files with safe extensions containing attacker-controlled content can be uploaded and included
• Bypassing access controls to obtain sensitive data
• Achieving arbitrary file inclusion and execution on the server

Technical summary

The LifterLMS plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This allows authenticated attackers with Instructor-level access and above to include and execute arbitrary files on the server, potentially leading to code execution, data breaches, or access control bypass. The vulnerability is due to the llms_get_template() helper performing extract() on the shortcode attribute array before resolving the template path.

Defensive priority

High

Recommended defensive actions

• Assess exposure of LifterLMS installations to version 10.3.1 or earlier
• Verify if Instructor-level access or higher is present in the environment
• Review server logs for potential exploitation attempts
• Apply vendor remediation when available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the LifterLMS plugin vulnerability. The NVD entry is currently not provided. The vulnerability allows authenticated attackers with Instructor-level access and above to include and execute arbitrary files on the server. Defenders should verify server logs for potential exploitation attempts and apply vendor remediation when available. The source item provides vulnerability details, but additional verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.