CyberRota Analysis
AI-GeneratedThe LifterLMS WordPress plugin prior to version 10.0.10 is vulnerable due to inadequate capability checks in its AJAX handlers, permitting authenticated users with subscriber-level access to read sensitive internal post type titles, including coupon codes. This could lead to unauthorized information disclosure, potentially impacting the confidentiality of sensitive data. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.