CVE-2026-110284

Name of the Vulnerable Software and Affected Versions LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes versions prior to 10.3.2

Description An issue exists where authenticated users with Instructor-level access or higher can perform Local File Inclusion. This occurs because the llms get template() function uses extract() on the attributes of the [lifterlms checkout] shortcode before resolving the template path. By manipulating the template name and default path attributes, an attacker can overwrite local parameters and control the path passed to a PHP include. This can lead to the execution of arbitrary files on the server, bypassing access controls, leaking sensitive data, or achieving remote code execution if files containing malicious content are uploaded.

Recommendations Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to version 10.3.2 or later.