PHP Object Injection Vulnerability in LifterLMS for WordPress

CVE-2026-104723

What is CVE-2026-104723?

The LifterLMS plugin for WordPress, used for eLearning and course management, has a vulnerability that allows authenticated attackers with custom-level access to exploit PHP Object Injection due to deserialization of untrusted input. This issue affects all versions up to and including 10.2.1. The vulnerability is particularly exploitable during lesson creation when a temporary lesson ID interacts with a custom metadata path. Although no inherent PHP Object Poisoning (POP) chain exists in the vulnerable plugin, the risk escalates if a theme or another plugin on the system has a POP chain. In such cases, attackers may delete arbitrary files, fetch sensitive information, or execute malicious code based on the POP chain present. Roles like Instructor, Instructor's Assistant, LMS Manager, or Administrator may trigger this vulnerability.

References