CVE-2026-110284 Details

A local file inclusion vulnerability has been identified in the LifterLMS WordPress plugin, specifically in versions through 10.3.1. The issue arises within the 'lifterlms_checkout' shortcode, where attacker-controlled attributes can be used to manipulate the template path. This is possible because the 'llms_get_template()' function extracts shortcode attributes before determining the template path, allowing attackers to overwrite local parameters and control the file path passed to a PHP include. As a result, authenticated attackers with Instructor-level access or higher can include and execute arbitrary files on the server. Exploitation of this vulnerability could lead to bypassing access controls, accessing sensitive data, or executing code, particularly if uploaded files with safe extensions containing malicious content can be included.

Users are advised to update the LifterLMS plugin to version 10.3.2 or a later patched version.