The affected LifterLMS plugin processes the attributes supplied to the [lifterlms_checkout] shortcode by extracting them into local variables before resolving a template path. A malicious user who can authenticate with Instructor-level or higher privileges can supply specially crafted 'template_name' and 'default_path' attributes. These values overwrite the internal variables that determine the file path passed to PHP include, enabling the inclusion of arbitrary files on the server. If the attacker can upload files with a recognized safe extension, they can place code and trigger its execution, or they can read sensitive files, effectively bypassing the site’s access controls. This flaw is a classic example of a Local File Inclusion (CWE‑98) vulnerability that can lead to execution beyond the plugin’s dedicated scope.

WordPress sites running the LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin on a version equal to or older than 10.3.1 are impacted. The vulnerability exists in the template and shortcode handling files within these releases. Sites that have updated to 10.3.2 or newer are not affected.

The CVSS score of 7.5 rates this as a high severity issue. The EPSS score of less than 1% indicates that the marketplace exploitation likelihood is low, and it is not currently listed in the CISA KEV catalog. Nonetheless, because exploitation requires only a user with Instructor or higher permissions to craft the shortcode attributes, a wide range of sites could be compromised if attackers gain or abuse legitimate credentials. The external visibility and impact of this flaw depend heavily on the privileges of the target user.