# LifterLMS <= 10.3.2 - Unauthenticated Missing Authorization to Protected Media Access

- **ID:** WPSEC-2026-2479
- **Plugin:** LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes (`lifterlms`), https://wordpress.org/plugins/lifterlms/
- **Affected versions:** from 9.0.0 before 11.0.0
- **Fixed in:** 11.0.0 (Update to 11.0.0 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/lifterlms
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2479/

## Description

The LifterLMS plugin for WordPress is vulnerable to unauthorized access of protected media in all versions up to, and including, 10.3.2 due to an insufficient authorization check when serving protected media files. Logged-out visitors (user ID 0) were treated as the uploader of protected media that has no author, and empty or invalid quiz IDs in the media meta were not filtered out. This makes it possible for unauthenticated attackers to download protected media files without an author that they should not be able to access.

## References

- https://wpsec.com/vuln/WPSEC-2026-2479/
- https://plugins.svn.wordpress.org/lifterlms/tags/11.0.0/
- https://wordpress.org/plugins/lifterlms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2479/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.