# LifterLMS <= 10.3.2 - Authenticated (Contributor+) Sensitive Information Exposure via REST API Students and Enrollments Collections

- **ID:** WPSEC-2026-2478
- **Plugin:** LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes (`lifterlms`), https://wordpress.org/plugins/lifterlms/
- **Affected versions:** all versions before 11.0.0
- **Fixed in:** 11.0.0 (Update to 11.0.0 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-203
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/lifterlms
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2478/

## Description

The LifterLMS plugin for WordPress is vulnerable to Sensitive Information Exposure via the REST API students and enrollments collection endpoints in all versions up to, and including, 10.3.2 due to collection queries not being scoped to the students the current user is allowed to read, while pagination totals were computed before per-item permission checks. This makes it possible for authenticated attackers with instructor-level access (the view_students capability without view_others_students) to enumerate students they are not permitted to view by combining the X-WP-Total header with the search parameter.

## References

- https://wpsec.com/vuln/WPSEC-2026-2478/
- https://plugins.svn.wordpress.org/lifterlms/tags/11.0.0/
- https://wordpress.org/plugins/lifterlms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2478/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.