CVE-2026-14231 — LifterLMS < 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2_query_posts

CVE-2026-14231

LifterLMS < 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2_query_posts PUBLISHED

Description (CNA)

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.

Affected (CNA)

Vendor / product	Versions
Unknown / LifterLMS	affected 0 before 10.0.10

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/2a353964-9f4c-4528-b187-42766f0cfaed/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.