LifterLMS <= 10.3.2 - Authenticated (Contributor+) Sensitive Information Exposure via REST API Students and Enrollments Collections
- ID
- WPSEC-2026-2478
- Plugin
- LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes (lifterlms)
- Affected
- all versions before 11.0.0
- Remediation
- Update to 11.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-203
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-04
- Attack surface
- LifterLMS on WPSec AttackSurface
- Fix released
- Published
Description
The LifterLMS plugin for WordPress is vulnerable to Sensitive Information Exposure via the REST API students and enrollments collection endpoints in all versions up to, and including, 10.3.2 due to collection queries not being scoped to the students the current user is allowed to read, while pagination totals were computed before per-item permission checks. This makes it possible for authenticated attackers with instructor-level access (the view_students capability without view_others_students) to enumerate students they are not permitted to view by combining the X-WP-Total header with the search parameter.
References
- https://wpsec.com/vuln/WPSEC-2026-2478/
- https://plugins.svn.wordpress.org/lifterlms/tags/11.0.0/
- https://wordpress.org/plugins/lifterlms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS