CVE-2019-15896: lifterlms
Vulnerability summary
CVE-2019-15896 is a critical (CVSS 9.8) vulnerability in lifterlms. EPSS estimates a 6.49% chance of exploitation in the next 30 days, higher than 93.7% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 3.35.0.
Timeline
- 10-09-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to an unauthenticated options import vulnerability that could lead to privilege escalation (administrator account creation), website redirection, and stored XSS.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
6.49%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 6.49% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (blog.nintechnet.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Lifterlms1 product
- lifterlms≤ 3.34.5
Wordpress1 product
- lifterlms< 3.35.0
2 vendors · 2 products
References
4 links- blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-lifterlms-plugin/X Refsource MISCExploitThird Party Advisory