CVE-2026-104723 in LifterLMS Plugin
Summary
by MITRE • 10/10/2026
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only exploitable during lesson creation when a temporary lesson ID triggers the custom metadata path, and requires the attacker to hold a role with the edit_course capability, such as Instructor, Instructor's Assistant, LMS Manager, or Administrator.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The security flaw identified in the LifterLMS plugin for WordPress represents a significant risk vector within the eLearning ecosystem, specifically classified under PHP Object Injection vulnerabilities. This issue persists across all versions up to and including 10.2.1, stemming from the unsafe deserialization of untrusted input data. The technical mechanism involves the application processing user-supplied data that is subsequently passed through PHP's unserialize function without adequate validation or sanitization. When a temporary lesson ID triggers the custom metadata path during the lesson creation process, this unchecked input allows an attacker to manipulate the object structure in memory. This aligns with Common Weakness Enumeration (CWE) category CWE-502, which denotes Deserialization of Untrusted Data, and is often associated with CWE-94 for Improper Control of Generation of Code or PHP Script, depending on the ultimate exploitation method.
The operational impact of this vulnerability is heavily dependent on the broader context of the WordPress installation rather than being immediately exploitable in isolation. The LifterLMS software itself does not contain a known Proof-of-Concept (POP) chain that would allow direct remote code execution or arbitrary file manipulation solely through its own classes. Consequently, an attacker cannot directly achieve full system compromise using only the vulnerabilities present within the plugin's core logic. However, this limitation is critical to understand because WordPress environments are typically modular, relying on numerous third-party plugins and themes. If any other component installed on the target server contains a compatible POP chain, the injected object can traverse that external codebase to trigger malicious side effects. These potential outcomes include deleting arbitrary files, retrieving sensitive database information, or executing arbitrary PHP code, effectively turning this deserialization flaw into a potent privilege escalation tool when combined with vulnerable dependencies.
Exploitation of this vulnerability requires specific preconditions regarding user authentication and role assignment. The attacker must possess valid credentials for an account that holds at least the edit_course capability. This restricts the threat model to authenticated users rather than unauthenticated attackers, significantly raising the barrier to entry but also targeting a broader set of potential adversaries within the application's intended user base. Roles such as Instructor, Instructor's Assistant, LMS Manager, or Administrator all possess this level of access and are therefore susceptible to being leveraged for exploitation. From an ATT&CK perspective, this behavior maps to techniques involving Initial Access via Valid Accounts and potentially Execution through Command Line Interface if the POP chain leads to code execution. The requirement for authenticated access means that organizations must enforce strict role-based access control (RBAC) principles to minimize the number of users with elevated privileges who could trigger the vulnerable metadata path.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. The primary defense is to update the LifterLMS plugin to a version where this deserialization issue has been patched, ensuring that input validation is strictly enforced before any unserialization occurs. In cases where updating is not immediately feasible, administrators should implement web application firewall rules to detect and block anomalous serialization patterns in POST requests related to lesson creation. Furthermore, since the risk is contingent on the presence of other vulnerable plugins or themes, a comprehensive audit of all installed WordPress components is essential to identify any existing POP chains that could be chained with this vulnerability. Enforcing least-privilege access models by limiting edit_course capabilities to only those users who absolutely require them can also reduce the attack surface. Regular security scanning and dependency management are critical in maintaining the integrity of complex WordPress environments where such chainable vulnerabilities pose a disproportionate risk compared to isolated flaws.