CVE-2019-15896

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to an unauthenticated options import vulnerability that could lead to privilege escalation (administrator account creation), website redirection, and stored XSS.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-lifterlms-plugin/Exploit, Third Party Advisory
https://wordpress.org/plugins/lifterlms/#developersRelease Notes
https://wpvulndb.com/vulnerabilities/9871Third Party Advisory
https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-lifterlms-plugin/Exploit, Third Party Advisory
https://wordpress.org/plugins/lifterlms/#developersRelease Notes
https://wpvulndb.com/vulnerabilities/9871Third Party Advisory

Timeline

Published: Sep 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-158979.6beegfs-ctl in ThinkParQ BeeGFS through 7.1.3 allows Authentication Bypass via communication with a BeeGFS metadata server (which is typicall CVE-2019-158986.1Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page.CVE-2019-15908.1A vulnerability in the Transport Layer Security (TLS) certificate validation functionality of Cisco Nexus 9000 Series Application Centric In CVE-2019-159009.8An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was us CVE-2019-159018.8An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A setusercontext(3) call with flags to change t CVE-2019-159025.6A backporting error was discovered in the Linux stable/longterm kernel 4.4.x through 4.4.190, 4.9.x through 4.9.190, 4.14.x through 4.14.141 CVE-2019-159037.5In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutiv CVE-2019-15917.8A vulnerability in a specific CLI command implementation of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, l CVE-2019-159107.5An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Attackers can utilize the "di CVE-2019-159119.8An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Because of insecure key trans CVE-2019-159127.5An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Attackers can use the ZigBee CVE-2019-159139.8An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices. Because of insecure key transport in ZigBee