CVE-2026-110284 Overview
CVE-2026-110284 is a Local File Inclusion (LFI) vulnerability in the LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress. The flaw affects all versions up to and including 10.3.1 and resides in the [lifterlms_checkout] shortcode handler. Authenticated users with Instructor-level permissions or higher can supply attacker-controlled template_name and default_path shortcode attributes that reach a PHP include call. Successful exploitation allows attackers to read arbitrary server files, bypass access controls, or achieve remote code execution when combined with upload primitives for files with safe extensions. The vulnerability is tracked under CWE-98: Improper Control of Filename for Include/Require Statement.
Critical Impact
Authenticated Instructor-level attackers can include arbitrary PHP files on the server, enabling sensitive data disclosure and potential remote code execution on affected WordPress sites.
Affected Products
- LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress
- All versions up to and including 10.3.1
- WordPress sites allowing Instructor-level or higher user registration
Discovery Timeline
- 2026-10-14 - CVE-2026-110284 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-110284
Vulnerability Analysis
The vulnerability lives in the llms_get_template() helper function in includes/functions/llms.functions.template.php. The function calls PHP's extract() on an attribute array sourced from shortcode attributes before resolving the template path. Because extract() promotes array keys into local variables, attacker-supplied shortcode attributes overwrite the function's named parameters, including template_name and default_path. The modified values then flow into a PHP include statement, producing a classic file inclusion sink.
The [lifterlms_checkout] shortcode is the exposed entry point. Its handler in class.llms.shortcode.checkout.php passes user-supplied attributes to the vulnerable template loader. Because WordPress Instructor accounts can author posts and insert shortcodes, any attacker holding Instructor privileges can inject a crafted [lifterlms_checkout] tag that resolves to arbitrary filesystem paths relative to the server.
Root Cause
The root cause is the unsafe use of extract() on untrusted input combined with the absence of allow-list validation on the resolved template path. Shortcode attributes should never be permitted to overwrite internal path variables, and template lookups should be constrained to a known directory with a verified file suffix. Source references: llms.functions.template.php line 102 and line 120.
Attack Vector
An authenticated attacker with Instructor-level access publishes or edits content containing a [lifterlms_checkout] shortcode with crafted template_name and default_path attributes. When the page renders, the plugin resolves and includes the attacker-chosen path. The attacker can target local PHP files to exfiltrate configuration data such as wp-config.php contents through subsequent reads, or chain the flaw with a file upload of a benign-extension file containing PHP to achieve code execution. See the Wordfence vulnerability analysis and the shortcode handler at class.llms.shortcode.checkout.php line 138 for additional context.
No verified proof-of-concept code is published in the enriched data; refer to the vendor advisory for technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-110284
Indicators of Compromise
- Posts, pages, or revisions containing [lifterlms_checkout] shortcodes with non-default template_name or default_path attributes, especially values containing ../, absolute paths, or references outside the plugin's templates directory.
- PHP include or include_once warnings in web server error logs referencing unexpected file paths at render time.
- Instructor or higher accounts editing checkout-related content outside of normal course publishing workflows.
Detection Strategies
- Audit the WordPress wp_posts table for shortcode patterns matching lifterlms_checkout and inspect attribute values for suspicious strings.
- Enable PHP error logging and alert on include() or require() warnings generated by llms.functions.template.php.
- Review access logs for POST requests to post.php or REST endpoints by Instructor accounts followed by GET requests rendering the modified page.
Monitoring Recommendations
- Track role changes and new Instructor-level account creation events in WordPress audit logs.
- Monitor file reads of sensitive files such as wp-config.php, /etc/passwd, or files inside wp-content/uploads with non-standard extensions.
- Correlate upload activity producing files with permissive extensions (.jpg, .png, .txt) with subsequent page renders that include those files.
How to Mitigate CVE-2026-110284
Immediate Actions Required
- Update the LifterLMS plugin to the version containing the fix from change set 3736899.
- Audit all Instructor-level and higher accounts; remove accounts that are inactive, unknown, or no longer required.
- Scan existing posts, pages, and drafts for anomalous [lifterlms_checkout] shortcode attributes and remove or revert them.
- Review the wp-content/uploads directory for files whose contents do not match their declared extension.
Patch Information
The maintainers addressed the issue in the LifterLMS code tree via change set 3736899, which modifies llms_get_template() to prevent attacker-supplied shortcode attributes from overriding the template path parameters. Site operators should upgrade to the fixed release published after version 10.3.1.
Workarounds
- Restrict shortcode privileges by removing Instructor and higher roles' ability to publish or edit posts containing arbitrary shortcodes until the patch is applied.
- Deploy a web application firewall rule that blocks requests containing lifterlms_checkout shortcode parameters with path traversal sequences or absolute paths.
- Harden PHP with open_basedir restrictions and disable_functions configuration to limit the impact of successful file inclusion.
- Temporarily disable the LifterLMS plugin on sites that do not require checkout functionality until the update is deployed.
# Example php.ini hardening to limit LFI blast radius
open_basedir = "/var/www/html:/tmp"
allow_url_include = Off
allow_url_fopen = Off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
