CVE-2026-110284

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the lifterlmscheckout shortcode. This is due to the llmsgettemplate helper performing extract o...

CVE-2026-110284

The LifterLMS WordPress plugin (versions up to and including 10.3.1 ) is vulnerable to Local File Inclusion (LFI) . The flaw exists in the llms_get_template() helper function, which improperly uses extract() on the [lifterlms_checkout] shortcode attribute array. This allows an authenticated attac...

CVE-2026-110284: Improper Control of Filename for Include/Require Statement in PHP Program

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the lifterlmscheckout shortcode. This is due to the llmsgettemplate helper performing extract o...