CVE-2023-6160

MEDIUM 6.7CVE-2023-6160 · Published 22/11/2023 · updated 17/06/2026

In short

CVE-2023-6160 is a MEDIUM (CVSS 6.7) vulnerability affecting lifterlms (lifterlms).
Chance of exploitation in the next 30 days (EPSS): 0.82%, higher than 57.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
lifterlms lifterlms	`≤ 7.4.2`	No fix yet

Description

The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 7.4.2 via the maybe_serve_export function. This makes it possible for authenticated attackers, with administrator or LMS manager access and above, to read the contents of arbitrary CSV files on the server, which can contain sensitive information as well as removing those files from the server.

References

plugins.trac.wordpress.org/changeset/2989461 · Third Party Advisory
wordfence.com/threat-intel/vulnerabilities/id/6d0fcd82-6d4a-454f-8056-a896e8d41d00 · Third Party Advisory

More vulnerabilities in lifterlms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

lifterlms

≤ 7.4.2

No fix yet

Description

More vulnerabilities in lifterlms

See all →