Listen to this Post
How the CVE Works
The vulnerability in LifterLMS (up to v8.0.1) stems from a missing capability check in the `delete_access_plan` function and its related AJAX actions. Unauthenticated attackers can exploit this flaw by sending crafted requests to the affected endpoints, forcing arbitrary published posts into the “Trash” state. This manipulation occurs without requiring authentication, effectively disrupting website content availability by trashing critical posts, courses, or quizzes. The lack of CSRF protection further exacerbates the issue, enabling widespread abuse.
DailyCVE Form
Platform: WordPress (LifterLMS)
Version: ≤ 8.0.1
Vulnerability: Unauthenticated Post Trashing
Severity: Critical
Date: 2025-03-19
Prediction: Patch expected by 2025-08-15
What Undercode Say
Analytics:
curl -X POST http://<target>/wp-admin/admin-ajax.php -d "action=delete_access_plan&post_id=<ID>"
SELECT FROM wp_posts WHERE post_status = 'trash'; -- Verify exploitation
How Exploit
1. Identify target sites running LifterLMS ≤ 8.0.1.
- Craft AJAX request to `delete_access_plan` with arbitrary
post_id.
3. Mass-trash posts via automated scripts.
Protection from this CVE
1. Update to LifterLMS > 8.0.1.
2. Implement WAF rules blocking unauthorized `admin-ajax.php` calls.
3. Apply least-privilege role capabilities.
Impact
- Unauthorized content disruption.
- Denial-of-service (DoS) via mass trashing.
- Reputation damage for affected eLearning platforms.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
