What is the CVSS score of CVE-2026-14231?

CVE-2026-14231 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-14231?

Yes, a public proof-of-concept exploit is available for CVE-2026-14231. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-14231?

Yes, a patch is available for CVE-2026-14231. Update the affected software to the latest version immediately.

LifterLMS CVE-2026-14231

EUVD-2026-50994 MEDIUM

Information Exposure (CWE-200)

2026-07-30 WPScan

GHSA-hqvc-w7p2-cpm5

WordPress Information Disclosure Lifterlms Unknown

4.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

PR:L is accurate as subscriber-level authentication is the minimum requirement; C:L reflects exposure of post titles only, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:37 vuln.today

CVSS changed

Jul 30, 2026 - 15:22 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 07:03 EUVD

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 06:00 cve.org

MEDIUM 4.3

DescriptionCVE.org

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.

AnalysisAI

Authenticated information disclosure in the LifterLMS WordPress plugin before 10.0.10 exposes internal post type titles - including coupon codes - to any subscriber-level user. The root cause is a missing capability check in a select2 query AJAX handler that only verifies login status, not whether the user holds an appropriate WordPress capability. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at just 0.16% (5th percentile), indicating low broad exploitation likelihood; no active exploitation is confirmed by CISA KEV.

Technical ContextAI

LifterLMS is a widely-used Learning Management System plugin for WordPress. The affected code path is a server-side AJAX handler powering a select2 dropdown UI component (a jQuery-based search-select library). This handler accepts a post_type parameter from the client and runs a WP_Query to return matching post titles. The handler performs a simple is_user_logged_in() check but omits the critical current_user_can() capability check that would restrict access to privileged roles. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) captures this precisely: data gated only by authentication, not authorization. Affected CPE: cpe:2.3:a:unknown:lifterlms:*:*:*:*:*:*:*:*, all versions prior to 10.0.10.

RemediationAI

Update LifterLMS to version 10.0.10 or later - this is the vendor-released patch that introduces the missing capability check in the affected AJAX handler. The patch is confirmed available per vendor advisory (https://wpscan.com/vulnerability/2a353964-9f4c-4528-b187-42766f0cfaed/). If immediate patching is not feasible, restrict site registration to trusted users only and audit whether any untrusted subscribers exist on the WordPress installation, as subscriber-level accounts are the minimum prerequisite for exploitation. Blocking unauthenticated or subscriber users from reaching /wp-admin/admin-ajax.php via WAF rules is a possible mitigating control but carries the trade-off of breaking legitimate plugin AJAX functionality for those roles.