CVE-2026-110284: LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlmscheckout] shortcode. This is due to the llmsgettemplate() helper performing extract() on the shortcode attribute array before resolving the template path, which allows the attacker-supplied 'templatename' and 'defaultpath' shortcode attributes to overwrite the function's local parameters and ultimately control the path passed to a PHP include. This makes it possible for authenticated attackers, with Instructor-level access and above, to include and execute arbitrary files on the server, that can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with safe extensions containing attacker-controlled content can be uploaded and included.
Affected Software
Event History
Frequently Asked Questions
Which users could exploit this issue?
An authenticated user with Instructor-level access or higher can exploit it. Lower-privileged authenticated users are not identified as able to exploit it in the available information.
What must an attacker control to exploit the vulnerability?
The attacker needs to supply attributes to the lifterlms_checkout shortcode, specifically template_name and default_path. Those attributes can overwrite local parameters used when resolving the file path for a PHP include.
Does exploitation require a separate uploaded payload?
Not necessarily for local file inclusion, but code execution depends on an includable file with a safe extension that contains attacker-controlled content. Such a file may be uploaded and then included where uploads and file contents permit it.
What impact should defenders consider if exploitation succeeds?
Successful exploitation can include arbitrary server-local files and execute them through PHP inclusion. The stated outcomes include access-control bypass, exposure of sensitive data, and possible code execution.