CVE-2026-110284

7.5High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-98

Impact

Authenticated attackers with Instructor-level access or higher can read sensitive files or achieve arbitrary code execution via local file inclusion. Attackers need a valid WordPress account with instructor privileges and the ability to post or edit shortcodes.

Root cause

The llms_get_template() function runs extract() directly on shortcode attributes, allowing user-supplied inputs to overwrite internal template path variables passed into a PHP include call.

Affected systems

LifterLMS plugin for WordPress versions up to and including 10.3.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade LifterLMS to a version higher than 10.3.1. If patching immediately is not possible, restrict or disable Instructor-level accounts and audit posts containing the [lifterlms_checkout] shortcode.

shell

$ wp plugin update lifterlms

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing extract() on the shortcode attribute array before resolving the template path, which allows the attacker-supplied 'template_name' and 'default_path' shortcode attributes to overwrite the function's local parameters and ultimately control the path passed to a PHP include. This makes it possible for authenticated attackers, with Instructor-level access and above, to include and execute arbitrary files on the server, that can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with safe extensions containing attacker-controlled content can be uploaded and included.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110284