CVE-2023-6160: LifterLMS <= 7.4.2 - Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletion
The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 7.4.2 via the maybeserveexport function. This makes it possible for authenticated attackers, with administrator or LMS manager access and above, to read the contents of arbitrary CSV files on the server, which can contain sensitive information as well as removing those files from the server.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this LifterLMS plugin?
The vulnerability ID for this LifterLMS plugin is CVE-2023-6160.
What is the severity of CVE-2023-6160?
The severity of CVE-2023-6160 is medium with a CVSS score of 6.7.
How does this vulnerability affect the LifterLMS plugin?
This vulnerability affects the LifterLMS plugin versions up to and including 7.4.2.
How can authenticated attackers exploit this vulnerability?
Authenticated attackers with administrator or LMS manager access and above can exploit this vulnerability to perform directory traversal and read sensitive files.
Are there any references related to CVE-2023-6160?
Yes, you can find references related to CVE-2023-6160 at the following links: [Wordfence](https://www.wordfence.com/threat-intel/vulnerabilities/id/6d0fcd82-6d4a-454f-8056-a896e8d41d00?source=cve) and [WordPress Plugin Directory](https://plugins.trac.wordpress.org/changeset/2989461/).