CVE-2026-14231 Overview
CVE-2026-14231 affects the LifterLMS WordPress plugin in versions prior to 10.0.10. The plugin fails to perform a capability check in one of its select2 query AJAX handlers. The handler only verifies that the requesting user is authenticated, without validating that the user holds appropriate permissions for the requested resource.
Any authenticated user with subscriber-level access can invoke the vulnerable AJAX endpoint. By supplying an internal post type as a parameter, the attacker retrieves post titles that should remain restricted, including coupon codes.
Critical Impact
Authenticated subscribers can enumerate titles of internal post types, including coupon codes, leading to disclosure of privileged content and potential financial abuse.
Affected Products
- LifterLMS WordPress plugin versions prior to 10.0.10
Discovery Timeline
- 2026-07-30 - CVE-2026-14231 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-14231
Vulnerability Analysis
The vulnerability is a Missing Authorization flaw in a WordPress plugin AJAX handler. LifterLMS exposes select2-driven query endpoints so administrators can search across various post types when building courses, coupons, and other resources. One of these handlers implements only an authentication check via a nonce or is_user_logged_in(), but omits a capability check such as current_user_can().
Because WordPress installations often permit self-registration at the subscriber role, any user who registers gains access to the endpoint. The handler accepts a post type parameter from the client and returns matching post titles. This treats an attacker-controlled parameter as trusted input for resource selection.
The disclosed data includes coupon codes stored as internal post types. Attackers can enumerate valid coupons and reuse them for discounts, causing direct financial impact to site operators using LifterLMS for paid course sales.
Root Cause
The root cause is the absence of a role or capability verification step in the AJAX handler. The developer relied solely on authentication state to gate access, rather than verifying that the authenticated user has permission to view administrative post types. This is a broken access control pattern common in WordPress plugin AJAX handlers.
Attack Vector
Exploitation requires an authenticated session at the subscriber level. The attacker sends a POST request to the plugin's admin-ajax.php handler, specifying the vulnerable action and the target internal post type. The server returns matching titles, which the attacker parses to harvest coupon codes or other restricted content. No user interaction from an administrator is required.
Refer to the WPScan Vulnerability Report for additional technical details.
Detection Methods for CVE-2026-14231
Indicators of Compromise
- Unusual volume of authenticated POST requests to wp-admin/admin-ajax.php referencing LifterLMS select2 query actions from subscriber accounts.
- Requests containing internal post type parameters such as llms_coupon originating from non-administrative users.
- Sudden appearance of previously unused coupon codes being redeemed at checkout.
Detection Strategies
- Enable WordPress access logging and alert on subscriber-role users invoking administrative AJAX actions.
- Correlate authentication events with subsequent AJAX activity to identify newly registered accounts probing plugin endpoints.
- Inspect web server logs for repeated queries against admin-ajax.php with varying post type parameters, indicating enumeration.
Monitoring Recommendations
- Monitor coupon redemption rates and flag statistically abnormal usage of newly created or previously dormant codes.
- Track newly registered subscriber accounts against subsequent request patterns to detect scripted enumeration.
- Deploy a web application firewall rule to log LifterLMS AJAX actions and review calls made by low-privilege sessions.
How to Mitigate CVE-2026-14231
Immediate Actions Required
- Upgrade the LifterLMS WordPress plugin to version 10.0.10 or later on all sites.
- Audit existing subscriber accounts for signs of enumeration activity or coupon abuse.
- Rotate any coupon codes that may have been exposed prior to patching.
Patch Information
The vendor addressed the issue in LifterLMS version 10.0.10 by adding a proper capability check to the affected select2 AJAX handler. Site operators should apply the update through the WordPress plugin manager. See the WPScan Vulnerability Report for reference.
Workarounds
- Disable open user registration on affected WordPress sites until the plugin is updated.
- Restrict access to admin-ajax.php for the vulnerable action via a web application firewall rule that blocks subscriber-role requests referencing internal post types.
- Invalidate and reissue all active coupon codes if immediate patching is not possible.
# Example: block subscriber access to internal post types via .htaccess/WAF rule
# Adjust the action name to match the vulnerable handler documented in the advisory.
RewriteEngine On
RewriteCond %{REQUEST_URI} admin-ajax\.php$
RewriteCond %{QUERY_STRING} post_type=(llms_coupon|llms_[a-z_]+_internal) [NC]
RewriteRule .* - [F,L]
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
