CVE-2019-15896: Lifterlms

Critical severity, CVSS 9.8. EPSS: 6.5% chance of exploitation in the next 30 days.

An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to an unauthenticated options import vulnerability that could lead to privilege escalation (administrator account creation), website redirection, and stored XSS.

Affected products

• Lifterlms Lifterlms: up to and including 3.34.5

Published 2019-09-10. Last modified 2026-06-17.