Description
WordPress Plugin LifterLMS-WP LMS for eLearning, Online Courses, & Quizzes is prone to a vulnerability that lets attackers write or overwrite arbitrary files on an affected computer in the context of the web server. An attacker can exploit this vulnerability to write or overwrite arbitrary files. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. WordPress Plugin LifterLMS-WP LMS for eLearning, Online Courses, & Quizzes version 3.37.14 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 3.37.15 or latest
References
Related Vulnerabilities
AbanteCart Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2022-26521)
Contao Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2021-37626)
WordPress Plugin Contact Form 7-PayPal Add-on Cross-Site Request Forgery (1.3.4)
MOVEit Transfer Improper Privilege Management Vulnerability (CVE-2025-2324)
GeoServer Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2025-30145)