LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes Security & Risk Analysis

LifterLMS v9.2.1 exhibits a mixed security posture. On the positive side, the static analysis shows a robust implementation of security best practices, with a high percentage of SQL queries using prepared statements and output escaping. The plugin also demonstrates a good number of capability checks and nonce checks, indicating an effort to secure its entry points. Crucially, there are no unprotected AJAX handlers or REST API routes, and the taint analysis revealed no critical or high severity flows, suggesting the immediate code is relatively clean in these areas.

However, several concerns arise. The presence of 6 'unserialize' calls is a significant red flag, as this function is notoriously prone to deserialization vulnerabilities if not handled with extreme care and proper input validation. While taint analysis did not find immediate critical issues, the potential for exploitation with unsanitized paths in 7 flows needs careful consideration and review. The plugin's vulnerability history is also a major concern, with 15 known CVEs including critical and high severity issues. While there are currently no unpatched vulnerabilities, the recurring types like Improper Privilege Management, Missing Authorization, SQL Injection, and XSS suggest systemic weaknesses that have historically impacted the plugin. The last reported vulnerability being very recent (2025-11-12) also suggests ongoing security challenges.

In conclusion, while LifterLMS v9.2.1 demonstrates good coding practices in areas like prepared statements and output escaping, the historical vulnerability trend and the presence of dangerous functions like 'unserialize' necessitate vigilance. The potential for issues stemming from unsanitized paths, even if not currently rated as critical, adds to the overall risk profile. The plugin requires ongoing monitoring and a proactive approach to security patching and code review.