LifterLMS vulnerabilities
We track 3 vulnerabilities in LifterLMS products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest LifterLMS vulnerabilities
- 7.5 High severity
LifterLMS – WP LMS for eLearning, Online…: Improper Control of Filename for Include/Require Statement in PHP Program
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llm
- 8.8 High severity
LifterLMS – WP LMS for eLearning, Online…: Deserialization of Untrusted Data
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers,
- 7.2 High severity
LifterLMS – WP LMS for eLearning, Online…: Improper Neutralization of Special Elements used in an SQL Command
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the 'order' parameter in all versions up to, and including, 7.7.5 due to insufficient escaping on the user supplied parameter and lack