CVE-2025-2290
LifterLMS <= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to "Trash" for every published post, therefore limiting the availability of the website's content.
| CWE | CWE-862 |
| Vendor | chrisbadgett |
| Product | lifterlms – wp lms for elearning, online courses, & quizzes |
| Published | Mar 19, 2025 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes
Be the first to know when new medium vulnerabilities affecting chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
chrisbadgett / LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
0 ≤ 8.0.1
References
Credits
Michael Mazzolini