CVE-2026-110284

Received Received - Intake

Local File Inclusion in LifterLMS WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Wordfence

Description

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing extract() on the shortcode attribute array before resolving the template path, which allows the attacker-supplied 'template_name' and 'default_path' shortcode attributes to overwrite the function's local parameters and ultimately control the path passed to a PHP include. This makes it possible for authenticated attackers, with Instructor-level access and above, to include and execute arbitrary files on the server, that can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with safe extensions containing attacker-controlled content can be uploaded and included.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110284

EUVD

EUVD-2026-100904

Affected Vendors & Products

Vendor	Product	Version / Range
lifterlms	LifterLMS	– WP LMS for eLearning, Online Courses, & Quizzes 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-98	The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

Executive Summary

This vulnerability is a Local File Inclusion (LFI) issue in the LifterLMS WordPress plugin versions up to 10.3.1. It occurs because the plugin's llms_get_template() function uses extract() on attacker-controlled shortcode attributes before resolving template paths. This allows attackers with Instructor-level access or higher to manipulate the template_name and default_path attributes to include arbitrary files on the server, potentially leading to code execution or data theft.

Detection Guidance

Check for unauthorized file inclusions by reviewing server logs for unusual [lifterlms_checkout] shortcode usage with attacker-controlled attributes like 'template_name' or 'default_path'. Inspect WordPress plugins directory for unexpected PHP files in uploads or template folders.

Impact Analysis

If you use the affected LifterLMS plugin, an authenticated attacker with Instructor-level access could exploit this to include and execute malicious files on your server. This could allow them to bypass security controls, steal sensitive data, or take full control of your WordPress site, depending on file permissions and uploaded content.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, including personally identifiable information (PII) or protected health information (PHI), depending on the site's content. Such breaches may violate GDPR, HIPAA, or other regulations, potentially resulting in legal penalties, fines, or reputational damage due to compromised data integrity and confidentiality.

Mitigation Strategies

Update the LifterLMS plugin to the latest version immediately. If an update is unavailable, disable the plugin temporarily. Restrict Instructor-level user permissions to minimum required access. Monitor server logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-110284. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70