LifterLMS CVE-2026-110284

Requires an authenticated account with Instructor-level privileges or above (PR:L) that can create or edit content rendering the [lifterlms_checkout] shortcode on LifterLMS versions up to and including 10.3.1. The specific prerequisite is attacker control over the shortcode's 'template_name' and 'default_path' attributes, which llms_get_template() passes through extract() before the include, letting them overwrite the resolved template path. File disclosure/inclusion works directly; achieving full remote code execution additionally requires the ability to upload a file with a safe (allowed) extension containing attacker-controlled content to an includable location, which is the main limiting factor reflected in the AC:H rating. Limiting factors overall: mandatory Instructor+ authentication and the conditional, upload-dependent path to code execution.

This is a genuine but constrained risk, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5 High) shows network-reachable exploitation with full confidentiality/integrity/availability impact, but two signals temper it: AC:H (high attack complexity) and PR:L (requires at least Instructor-level authentication). The Instructor-and-above privilege requirement is a meaningful barrier - this is not an anonymous internet-facing bug - and plain Local File Inclusion only escalates to full code execution 'in cases where files with safe extensions containing attacker-controlled content can be uploaded and included,' which is the source of the AC:H rating. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the finding originates from Wordfence research with direct source-code references to the vulnerable extract()/include pattern. Net: a credible, vendor-researched authenticated LFI/RCE in a popular plugin that warrants prompt patching for any multi-author LifterLMS site, but the privilege prerequisite and conditional RCE path place it below unauthenticated-RCE priority. Missing data to note explicitly: EPSS and POC status are absent from the input and cannot be assumed either way.

An attacker who holds (or phishes/registers into) an Instructor-level account on a LifterLMS site crafts content containing a [lifterlms_checkout] shortcode with malicious 'template_name' and 'default_path' attributes. Because llms_get_template() runs extract() on the attribute array, those attributes overwrite the function's internal path variables and steer a PHP include() to an attacker-chosen file, disclosing sensitive files or, if a safe-extension file with attacker-controlled content can be uploaded and referenced, executing code. No public exploit was identified in the provided data.