Description
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to "Trash" for every published post, therefore limiting the availability of the website's content.
Published: 2025-03-19
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Availability disruption
Action: Immediate Patch
AI Analysis

Impact

The LifterLMS WordPress plugin contains a missing capability check that permits any unauthenticated user to trigger the delete_access_plan AJAX routine, which moves every published post to the Trash folder. This flaw is identified as CWE‑862. The effect is a denial of service or content loss, compromising the availability of a website’s learning materials.

Affected Systems

Versions of the LifterLMS plugin published by Chris Badgett for WordPress, up to and including 8.0.1, are affected. Newer releases are assumed to contain the fix.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS probability is below 1%, suggesting limited exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. Attackers would use unauthenticated AJAX calls to trigger deletion, meaning no user credential is required. Despite the low current exploitation likelihood, the impact on content availability warrants prompt remediation.

Generated by OpenCVE AI on April 21, 2026 at 21:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the LifterLMS plugin to a release newer than 8.0.1, which restores the missing capability checks for the delete_access_plan AJAX actions.
  • If an immediate upgrade is not possible, add a custom snippet that hooks into wp_ajax_lifterlms_delete_access_plan and returns a 403 response for any user lacking the edit_posts capability.
  • As an interim protective measure, configure the site’s web‑server or firewall to block unauthenticated requests to the LifterLMS AJAX endpoints in admin‑ajax.php.

Generated by OpenCVE AI on April 21, 2026 at 21:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-6718 The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to "Trash" for every published post, therefore limiting the availability of the website's content.
History

Fri, 11 Jul 2025 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Lifterlms
Lifterlms lifterlms
CPEs cpe:2.3:a:lifterlms:lifterlms:*:*:*:*:*:wordpress:*:*
Vendors & Products Lifterlms
Lifterlms lifterlms

Wed, 19 Mar 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Mar 2025 04:45:00 +0000

Type Values Removed Values Added
Description The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to "Trash" for every published post, therefore limiting the availability of the website's content.
Title LifterLMS <= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Lifterlms Lifterlms
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:52:01.235Z

Reserved: 2025-03-13T16:43:28.074Z

Link: CVE-2025-2290

cve-icon Vulnrichment

Updated: 2025-03-19T14:03:39.001Z

cve-icon NVD

Status : Analyzed

Published: 2025-03-19T05:15:41.180

Modified: 2025-07-11T21:23:28.510

Link: CVE-2025-2290

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T22:00:26Z

Weaknesses