CVE-2026-14231 in LifterLMS Plugin
Summary
by MITRE • 07/30/2026
The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability in LifterLMS WordPress plugin versions prior to 10.0.10 represents a critical authorization flaw that undermines the security model of the platform. This issue stems from an insufficient capability check within one of the plugin's select2 query AJAX handlers, which is designed to provide autocomplete functionality for various post types. The flaw allows any authenticated user regardless of their role level to access restricted internal post type data including coupon codes and other sensitive information. This represents a clear violation of the principle of least privilege and demonstrates poor access control implementation within the plugin's codebase.
The technical nature of this vulnerability can be categorized under CWE-285, which addresses insufficient authorization checks in software systems. The flaw specifically manifests in the AJAX handler that processes select2 queries, where the code performs only a basic authentication check using is_user_logged_in() but fails to verify whether the requesting user possesses adequate permissions for the requested post type. This oversight enables attackers with subscriber-level access to enumerate and extract information from internal post types that should be restricted to administrators or specific privileged roles. The vulnerability operates through the plugin's AJAX endpoint which accepts a post_type parameter, allowing malicious actors to probe for sensitive data without proper authorization.
The operational impact of this vulnerability extends beyond simple information disclosure, as it creates potential pathways for further exploitation within the WordPress ecosystem. Subscribers who can access coupon codes and other internal post types may use this information for fraudulent activities or to gain insights into the platform's structure and content management. This unauthorized access could enable attackers to discover patterns in coupon usage, identify valuable content, or potentially exploit additional vulnerabilities that rely on knowledge of internal system structures. The implications are particularly concerning given that many WordPress installations treat subscriber accounts as low-privilege users who should not have access to administrative or sensitive operational data.
Security practitioners should implement immediate mitigations including updating to LifterLMS plugin version 10.0.10 or later, which contains the necessary capability checks to prevent unauthorized access. Organizations should also review their user role assignments and ensure that only trusted administrators have access to sensitive post types. The vulnerability aligns with ATT&CK technique T1213.002 for Data from Information Repositories, as it allows unauthorized data extraction from internal content management systems. Additionally, implementing proper input validation and capability verification in AJAX handlers should become standard practice across WordPress plugins, particularly those handling user queries against database content.
This vulnerability demonstrates the critical importance of proper access control implementation in web applications, where a single missing authorization check can expose sensitive information to unintended users. The flaw serves as a reminder that even seemingly benign features like autocomplete functionality must implement robust security measures. Organizations should conduct regular security assessments of their WordPress plugins and themes, paying particular attention to AJAX handlers and user-facing data retrieval mechanisms that may inadvertently expose internal system information to unauthorized parties.