LifterLMS CVE-2026-104723

Exploitation requires an authenticated account holding the edit_course capability - specifically Instructor, Instructor's Assistant, LMS Manager, or Administrator - not an anonymous visitor. The vulnerable deserialization is reachable ONLY during lesson creation, when a temporary lesson ID causes execution to enter the custom metadata path in class.llms.admin.builder.php; it is not triggerable through normal front-end or arbitrary admin requests. The single most important limiting factor is that the LifterLMS codebase contains no POP chain of its own: the injected object has no effect unless a SEPARATE plugin or theme installed on the same site provides a usable gadget chain. Therefore realistic impact (arbitrary file deletion, sensitive-data retrieval, or code execution) depends entirely on (1) the site granting course-editing roles to semi-trusted users and (2) the presence of a third-party POP gadget - absent either, there is no impact.

This is a high-CVSS (8.8) flaw whose real-world risk is substantially lower than the headline number because of a critical dependency stated in the description: the vulnerable code contains NO known POP (Property-Oriented Programming) chain, so the PHP Object Injection has NO impact on its own and only becomes exploitable if a separate plugin or theme with a usable POP gadget chain is installed. The CVSS vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) models the worst case assuming such a chain exists, but AC:L understates the real difficulty - exploitation is contingent on a gadget chain the attacker does not control, which is more accurately an AC:H condition. On other signals: there is no CISA KEV listing and no public POC referenced in the input, so there is no public exploit identified at time of analysis - no active-exploitation or SSVC exploitation signal is present. The attack also requires authenticated access (PR:L) at edit_course level (Instructor, Instructor's Assistant, LMS Manager, or Administrator), which are trusted roles, further narrowing the realistic attacker population. Net assessment: a conditional, authenticated, trusted-role vulnerability that is a real priority only on sites that combine LifterLMS with a second component carrying a POP chain and that grant course-editing roles to lower-trust users; otherwise it is a high-CVSS-but-low-real-risk issue. No EPSS score was provided in the input.

An attacker holding an Instructor or similar edit_course role begins creating a lesson in the LifterLMS course builder and supplies a crafted serialized payload in the custom metadata path triggered by a temporary lesson ID, injecting a PHP object during deserialization. On its own this does nothing, but if the site also runs a plugin or theme exposing a POP gadget chain, the injected object can be leveraged to delete files, read sensitive data, or execute code. No public exploit code is identified at time of analysis.