CVE-2026-110284
High · CVSS 7.5 (NVD) · fetched 2026-10-24
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing extract() on the shortcode attribute array before resolving the template path, which allows the attacker-supplied 'template_name' and 'default_path' shortcode attributes to overwrite the function's local parameters and ultimately control the path passed to a PHP include.
Remediation
Apply the updates and mitigations in the source advisory; if no fix is available, follow the advisory's guidance on restricting or discontinuing use.
Affected PHP branches
See the source advisory.
Source: NIST National Vulnerability Database (NVD) · retrieved 2026-10-24T13:48:10-04:00 · https://nvd.nist.gov/vuln/detail/CVE-2026-110284