The LifterLMS WordPress plugin, versions before 10.0.10, fails to enforce a proper capability check in its AJAX handler for the select2 query. An authenticated user with subscriber-level access can provide a post type parameter and retrieve the titles of internal post types, such as coupon codes, that are normally not exposed. This flaw allows a confidentiality breach by exposing sensitive data that should be restricted to higher‑privileged roles and is documented as CWE‑200.

The affected systems are all installations of the LifterLMS plugin on WordPress running any version earlier than 10.0.10. Subscribers or users with similar limited roles who are logged in can exploit the flaw. No specific operating system or PHP version is mentioned.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, further implying that it has not been observed in active attacks. Exploitation requires only that the user be logged in as a subscriber and to supply a post type value in the AJAX request; no elevated privileges or remote code execution are needed.