CVE-2023-6160 in LifterLMS Plugin
Summary
by MITRE • 11/22/2023
The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 7.4.2 via the maybe_serve_export function. This makes it possible for authenticated attackers, with administrator or LMS manager access and above, to read the contents of arbitrary CSV files on the server, which can contain sensitive information as well as removing those files from the server.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/11/2026
The vulnerability identified as CVE-2023-6160 affects the LifterLMS WordPress plugin, a popular eLearning platform that enables educational institutions and organizations to create and manage online courses. This security flaw exists within the plugin's file handling mechanisms and specifically impacts versions up to and including 7.4.2. The vulnerability stems from inadequate input validation within the maybe_serve_export function, which processes file export operations. Attackers exploiting this weakness can manipulate file paths through crafted requests, bypassing normal access controls that should restrict file system access to authorized users only. The issue particularly affects systems where the plugin is installed and configured with default settings or where security controls have not been properly implemented.
The technical exploitation of this directory traversal vulnerability occurs through authenticated attack vectors where malicious actors possess administrator or LMS manager privileges within the WordPress environment. These attackers can leverage the vulnerable function to access arbitrary CSV files stored on the server filesystem, potentially retrieving sensitive data including user credentials, personal information, course materials, and system configuration details. The vulnerability allows not only read access but also the capability to delete files from the server, amplifying the potential damage through both information disclosure and destructive operations. The lack of proper path validation and sanitization in the file handling process creates an opening for attackers to navigate beyond intended directories and access restricted system files. This weakness aligns with CWE-22, which specifically addresses improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal attacks.
The operational impact of this vulnerability extends beyond simple data theft, as it provides attackers with significant control over the affected WordPress installation's file system. Administrators may inadvertently expose sensitive information through exported CSV files that contain personal data, system configurations, or other confidential materials. The ability to delete files introduces additional risks including potential disruption of services, removal of critical system components, or destruction of course content and user data. Organizations relying on LifterLMS for educational delivery face particular risks as course materials, student records, and assessment data could be compromised. The vulnerability also undermines the integrity of the WordPress security model, as it allows privilege escalation through authenticated access to perform unauthorized file operations that should be restricted to legitimate administrative functions.
Mitigation strategies for CVE-2023-6160 require immediate action including updating the LifterLMS plugin to version 7.4.3 or later, which contains the necessary patches to address the directory traversal vulnerability. System administrators should implement the principle of least privilege by ensuring that only authorized personnel possess administrator or LMS manager roles within the WordPress environment. Additional protective measures include implementing web application firewalls that can detect and block suspicious file path traversal attempts, conducting regular security audits of plugin installations, and monitoring file system access logs for unusual activities. Organizations should also consider implementing file access controls and regular backup procedures to minimize potential damage from file deletion operations. The vulnerability demonstrates the importance of maintaining up-to-date software components and implementing proper input validation controls as recommended in the ATT&CK framework's defense-in-depth strategies for preventing privilege escalation and information disclosure attacks. Regular security assessments and vulnerability scanning should be conducted to identify similar weaknesses in other plugins or components within the WordPress ecosystem.