{
 "id": "WPSEC-2026-2478",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2478/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2478/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2478/index.md",
 "title": "LifterLMS <= 10.3.2 - Authenticated (Contributor+) Sensitive Information Exposure via REST API Students and Enrollments Collections",
 "description": "The LifterLMS plugin for WordPress is vulnerable to Sensitive Information Exposure via the REST API students and enrollments collection endpoints in all versions up to, and including, 10.3.2 due to collection queries not being scoped to the students the current user is allowed to read, while pagination totals were computed before per-item permission checks. This makes it possible for authenticated attackers with instructor-level access (the view_students capability without view_others_students) to enumerate students they are not permitted to view by combining the X-WP-Total header with the search parameter.",
 "plugin": {
  "slug": "lifterlms",
  "name": "LifterLMS",
  "full_name": "LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes",
  "wordpress_org": "https://wordpress.org/plugins/lifterlms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/lifterlms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/lifterlms"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-203"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "11.0.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 11.0.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "11.0.0",
 "remediation": "Update to 11.0.0 or later.",
 "fix_released": "2026-11-03T13:54:52+00:00",
 "published": "2026-11-04T14:58:24+00:00",
 "updated": "2026-11-04T13:58:11.082104+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2478/",
  "https://plugins.svn.wordpress.org/lifterlms/tags/11.0.0/",
  "https://wordpress.org/plugins/lifterlms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/lifterlms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-04"
 }
}