CVE-2025-2290
📋 TL;DR
The LifterLMS WordPress plugin has an unauthenticated post trashing vulnerability that allows attackers without credentials to move all published posts to the trash, making website content unavailable. This affects all WordPress sites using LifterLMS versions up to 8.0.1. The vulnerability stems from missing capability checks in AJAX handlers.
💻 Affected Systems
- LifterLMS - WP LMS for eLearning, Online Courses, & Quizzes
📦 What is this software?
Lifterlms by Lifterlms
⚠️ Risk & Real-World Impact
Worst Case
All published content becomes unavailable as posts are moved to trash, causing complete content disruption and potential business impact for e-learning sites.
Likely Case
Attackers trash published posts, disrupting website content availability and requiring manual restoration from backups.
If Mitigated
With proper access controls and monitoring, impact is limited to temporary content unavailability until restoration.
🎯 Exploit Status
Exploitation requires sending crafted AJAX requests to vulnerable endpoints without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.0.2 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3257328/lifterlms/trunk/includes/class.llms.ajax.handler.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find LifterLMS and click 'Update Now'. 4. Verify version is 8.0.2 or higher.
🔧 Temporary Workarounds
Disable vulnerable AJAX endpoints
allBlock access to the vulnerable AJAX handlers via web application firewall or .htaccess rules
# Add to .htaccess:
RewriteCond %{QUERY_STRING} action=delete_access_plan [NC]
RewriteRule .* - [F,L]
🧯 If You Can't Patch
- Disable LifterLMS plugin temporarily until patched
- Implement strict network access controls to limit AJAX endpoint exposure
🔍 How to Verify
Check if Vulnerable:
Check LifterLMS plugin version in WordPress admin panel under Plugins > Installed PluginsCheck Version:
wp plugin list --name=lifterlms --field=versionVerify Fix Applied:
Confirm LifterLMS version is 8.0.2 or higher and test AJAX endpoints with unauthenticated requests📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /wp-admin/admin-ajax.php with action=delete_access_plan from unauthenticated users
- Sudden increase in post status changes to 'trash'
Network Indicators:
- Unusual AJAX requests to WordPress admin endpoints from external IPs without authentication
SIEM Query:
source="wordpress.log" AND "admin-ajax.php" AND "delete_access_plan" AND NOT user_id=*