Vulnerabilities / LifterLMS / WPSEC-2026-2479
LifterLMS <= 10.3.2 - Unauthenticated Missing Authorization to Protected Media Access
Low 3.7
CWE-862Fixed in 11.0.0
- ID
- WPSEC-2026-2479
- Plugin
- LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes (lifterlms)
- Affected
- from 9.0.0 before 11.0.0
- Remediation
- Update to 11.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-04
- Attack surface
- LifterLMS on WPSec AttackSurface
- Fix released
- Published
Description
The LifterLMS plugin for WordPress is vulnerable to unauthorized access of protected media in all versions up to, and including, 10.3.2 due to an insufficient authorization check when serving protected media files. Logged-out visitors (user ID 0) were treated as the uploader of protected media that has no author, and empty or invalid quiz IDs in the media meta were not filtered out. This makes it possible for unauthenticated attackers to download protected media files without an author that they should not be able to access.
References
- https://wpsec.com/vuln/WPSEC-2026-2479/
- https://plugins.svn.wordpress.org/lifterlms/tags/11.0.0/
- https://wordpress.org/plugins/lifterlms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS