Read the docs
TI-2025-10932 Aliases CVE-2025-11923GHSA-94p8-7w5j-wvcj

Improper privilege management in chrisbadgett LifterLMS – WP LMS for eLearning, Online…

Priority MEDIUM 40CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not properly validating a user's identity prior to allowing them to modify their own role via the REST API. The permission check in the update_item_permissions_check() function returns true when a user updates their own account without verifying the role changes. This makes it possible for authenticated attackers, with student-level access and above, to escalate their privileges to administrator by updating their own roles array via a crafted REST API request. Another endpoint intended for instructors also provides an attack vector. Affected version ranges are 3.5.3-3.41.2, 4.0.0-4.21.3, 5.0.0-5.10.0, 6.0.0-6.11.0, 7.0.0-7.8.7, 8.0.0-8.0.7, 9.0.0-9.0.7, 9.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0035 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
chrisbadgettLifterLMS – WP LMS for eLearning, Online Courses, & Quizzes3.5.3 – 3.41.1; 4.0.0 – 4.21.3; 5.0.0 – 5.10.0; 6.0.0 – 6.11.0; 7.0.0 – 7.8.7; 8.0.0 – 8.0.7; 9.0.0 – 9.0.7; 9.1.0—No fix listedCNA
  • LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes Vendorchrisbadgett Affected 3.5.3 – 3.41.1; 4.0.0 – 4.21.3; 5.0.0 – 5.10.0; 6.0.0 – 6.11.0; 7.0.0 – 7.8.7; 8.0.0 – 8.0.7; 9.0.0 – 9.0.7; 9.1.0 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:lifterlms:lifterlms:*:*:*:*:*:*:*:*——chrisbadgett
  • cpe:2.3:a:lifterlms:lifterlms:*:*:*:*:*:*:*:* Versions — — ·chrisbadgett

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-11923
  2. 2026-10-03 Alias added: GHSA-94p8-7w5j-wvcj

References

Other 4

  • TI-2024-12660 LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS CVSS 3.1MEDIUM 6.1
  • TI-2019-11948 An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. CVSS 3.1CRITICAL 9.8
  • TI-2020-04909 LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution CVSS 3.1CRITICAL 9.8
  • TI-2025-32767 WordPress LifterLMS plugin <= 8.0.6 - SQL Injection Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-04416 LifterLMS – WordPress LMS Plugin for eLearning <= 7.6.2 - Authenticated (Contributor+) SQL Injection via Shortcode CVSS 3.1HIGH 8.8
  • TI-2026-70248 PHP object injection in LifterLMS via custom lesson data CVSS 3.1HIGH 8.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences