LifterLMS – WP LMS for ELearning, Online Courses, & Quizzes (<= 10.2.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/lifterlms--wp-lms-for-elearning-online-courses--quizzes--10.2.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 10 Oct 2026 07:50:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPHP Object Injection Vulnerability in LifterLMS Pluginhttps://feed.craftedsignal.io/briefs/2026-10-lifterlms-rce/Sat, 10 Oct 2026 07:50:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-lifterlms-rce/The LifterLMS WordPress plugin is vulnerable to authenticated PHP Object Injection, allowing attackers with edit_course capabilities to potentially execute code if a compatible POP chain exists elsewhere in the environment.The LifterLMS plugin for WordPress, in versions up to and including 10.2.1, contains an insecure deserialization vulnerability identified as CVE-2026-104723. The vulnerability exists within the lesson creation process, where the plugin improperly handles untrusted input during the metadata processing phase. To exploit this, an attacker must possess an account with at least 'edit_course' capabilities, such as an Instructor or LMS Manager.

While the LifterLMS codebase itself does not contain a Property-Oriented Programming (POP) chain, the vulnerability allows an attacker to inject arbitrary PHP objects that can be exploited if other plugins or themes installed on the same WordPress instance provide the necessary gadgets. Successful exploitation, in conjunction with a separate vulnerable component, may lead to arbitrary file deletion, unauthorized data retrieval, or remote code execution. This highlights the risk posed by the aggregate attack surface of complex CMS environments where multiple plugins interact.

Impact

The impact of this vulnerability is contingent upon the presence of auxiliary POP chains within the WordPress environment. If a chain is present, an attacker could achieve full site compromise, execute remote code, or modify sensitive system files. The vulnerability specifically targets environments using LifterLMS for course management, exposing educational institutions and online training platforms to potential data breaches and service disruption.

Recommendation

  • Upgrade LifterLMS to a version beyond 10.2.1 immediately to resolve the underlying deserialization flaw.
  • Audit the WordPress environment for unused plugins or themes, as these may contain POP chains that could be leveraged by this vulnerability.
  • Apply the principle of least privilege by reviewing user roles and stripping 'edit_course' capabilities from any accounts that do not strictly require them for course administration.
  • Implement Web Application Firewall (WAF) rules to monitor for suspicious POST requests containing serialized PHP objects directed at lesson creation endpoints.
]]>highadvisory