CVE-2026-104723: LifterLMS WordPress Plugin Object Injection

CVE-2026-104723 Overview

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress contains a PHP Object Injection vulnerability affecting all versions up to and including 10.2.1. The flaw results from deserialization of untrusted input inside the admin builder component. Authenticated attackers with custom-level access or above can inject arbitrary PHP objects during lesson creation when a temporary lesson ID triggers the custom metadata path. Exploitation requires a role with the edit_course capability, such as Instructor, Instructor's Assistant, LMS Manager, or Administrator. The vulnerability maps to [CWE-502: Deserialization of Untrusted Data].

Critical Impact
If another installed plugin or theme supplies a Property-Oriented Programming (POP) chain, attackers can delete arbitrary files, exfiltrate sensitive data, or execute code on the WordPress host.

Affected Products

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress
All plugin versions up to and including 10.2.1
WordPress sites where additional plugins or themes expose a usable POP chain

Discovery Timeline

2026-10-10 - CVE-2026-104723 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-104723

Vulnerability Analysis

The vulnerability lives in includes/admin/class.llms.admin.builder.php, the server-side handler for LifterLMS course construction. During lesson creation, the builder processes custom metadata keyed by a temporary lesson ID. The handler passes attacker-controlled input to PHP's unserialize() without validating its structure or origin. Any authenticated user holding the edit_course capability can submit a crafted serialized payload, which PHP will instantiate as live objects. The LifterLMS codebase itself does not ship a known POP chain, so direct impact depends on secondary code. When any other installed plugin or theme defines magic methods such as __wakeup() or __destruct() that touch filesystem, database, or network sinks, the injected object can pivot into arbitrary file deletion, data disclosure, or remote code execution.

Root Cause

The root cause is unsafe deserialization of client-supplied data in the admin builder path, classified as [CWE-502]. The code trusts serialized strings submitted through the lesson metadata workflow instead of using safe formats such as JSON or validating the serialized schema before reconstruction.

Attack Vector

The attack vector is network-based and requires authentication at Instructor level or higher. The attacker submits a crafted serialized payload through the LifterLMS builder endpoint during lesson creation, aiming the payload at the temporary lesson ID branch that invokes custom metadata handling. Successful object instantiation triggers any POP gadget available in the WordPress runtime. For technical details see the Wordfence Vulnerability Report and the vulnerable code paths at class.llms.admin.builder.php L458, L993, L1218, and L1576.

No verified proof-of-concept code is published. The vulnerability manifests when the builder deserializes attacker-controlled metadata during lesson creation.

Detection Methods for CVE-2026-104723

Indicators of Compromise

Lesson metadata fields containing serialized PHP markers such as O: (object), a: (array), or s: strings submitted through the LifterLMS builder.
Unexpected file deletions, new PHP files in wp-content/uploads/, or outbound connections originating from the PHP-FPM worker shortly after Instructor-level activity.
WordPress audit log entries showing lesson creation events from accounts that do not normally author courses.

Detection Strategies

Inspect HTTP POST bodies to LifterLMS admin AJAX and REST endpoints for strings matching the pattern O:\d+:"[A-Za-z_\\]+":\d+: within metadata fields.
Correlate edit_course capability usage with filesystem writes or process spawns from the webserver user to identify POP-chain execution.
Enable PHP error logging and alert on deserialization-related warnings referencing __wakeup or class instantiation during builder requests.

Monitoring Recommendations

Forward WordPress and webserver logs to a centralized analytics platform and build detections for serialized payloads targeting LifterLMS routes.
Monitor privileged WordPress roles (Instructor, LMS Manager, Administrator) for anomalous lesson creation volumes.
Baseline outbound connections from the PHP runtime and alert on new destinations following LifterLMS builder requests.

How to Mitigate CVE-2026-104723

Immediate Actions Required

Upgrade LifterLMS to the patched release that follows version 10.2.1 as published in the WordPress LifterLMS Changeset.
Audit all WordPress accounts holding the edit_course capability and revoke access that is not business-justified.
Inventory installed plugins and themes to identify components that could supply a POP chain and remove unused extensions.

Patch Information

The LifterLMS maintainers resolved the deserialization path in commit changeset 3729229, applied to includes/admin/class.llms.admin.builder.php. Site operators must update the plugin through the WordPress admin dashboard or WP-CLI (wp plugin update lifterlms) to apply the fix. Review the diff via the WordPress LifterLMS Changeset before deployment.

Workarounds

Temporarily restrict the Instructor, Instructor's Assistant, and LMS Manager roles until the plugin is upgraded.
Deploy a web application firewall rule that blocks serialized PHP patterns (O:, a:) in LifterLMS builder parameters.
Disable the LifterLMS plugin on production sites that cannot immediately patch and that have additional plugins known to expose POP gadgets.

bash

# Update LifterLMS via WP-CLI once a patched release is installed
wp plugin update lifterlms

# Audit users with the edit_course capability
wp user list --role=administrator --fields=ID,user_login,user_email
wp user list --role=lms_manager --fields=ID,user_login,user_email
wp user list --role=instructor --fields=ID,user_login,user_email