PULSE
LIVE28signals / 24h
ES
FEED
ransomqilin reclama a TenSparrows · US · Not Foundransomcmdorganization reclama a Collge Mont Notre-Dame de Sherbrooke · CA · Educationransomqilin reclama a Db Tarimsal Enerji · TR · Agriculture and Food Productionransomcmdorganization reclama a Rondout Electric · US · Energy & Utilitiesransomqilin reclama a Byonyks · US · Technologyransomqilin reclama a Prenisac · US · Not Foundransomqilin reclama a Excel Consultores · MX · Professional Servicesransomqilin reclama a Affinity Capital · US · Financial Servicesransomkairos reclama a Warwick Fabrics · NZ · Manufacturingransomgunra reclama a Siam Stabilizers and Chemicals Co., Ltd. / SSC · TH · Manufacturingransomqilin reclama a Adpo · Otherransomqilin reclama a servitelco · CL · Technologyransomqilin reclama a Orimar · BE · Otherransomqilin reclama a Indian Motos Inmot · EC · Manufacturingransomqilin reclama a TenSparrows · US · Not Foundransomcmdorganization reclama a Collge Mont Notre-Dame de Sherbrooke · CA · Educationransomqilin reclama a Db Tarimsal Enerji · TR · Agriculture and Food Productionransomcmdorganization reclama a Rondout Electric · US · Energy & Utilitiesransomqilin reclama a Byonyks · US · Technologyransomqilin reclama a Prenisac · US · Not Foundransomqilin reclama a Excel Consultores · MX · Professional Servicesransomqilin reclama a Affinity Capital · US · Financial Servicesransomkairos reclama a Warwick Fabrics · NZ · Manufacturingransomgunra reclama a Siam Stabilizers and Chemicals Co., Ltd. / SSC · TH · Manufacturingransomqilin reclama a Adpo · Otherransomqilin reclama a servitelco · CL · Technologyransomqilin reclama a Orimar · BE · Otherransomqilin reclama a Indian Motos Inmot · EC · Manufacturing
← All CVEs
CVE WatchJul 30, 2026

CVE-2026-14231

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Jul 30, 2026 · Last modified: Jul 30, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.

Official references
Related CVEs

No related CVEs by CWE or product.