CVE-2023-6160

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 7.4.2 via the maybe_serve_export function. This makes it possible for authenticated attackers, with administrator or LMS manager access and above, to read the contents of arbitrary CSV files on the server, which can contain sensitive information as well as removing those files from the server.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
chrisbadgett	LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes	<= 7.4.2

References

https://plugins.trac.wordpress.org/changeset/2989461/Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/6d0fcd82-6d4a-454f-8056-a896e8d41d00?source=cveThird Party Advisory
https://plugins.trac.wordpress.org/changeset/2989461/Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/6d0fcd82-6d4a-454f-8056-a896e8d41d00?source=cveThird Party Advisory

Timeline

Published: Nov 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-61616.1The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to CVE-2023-61634.8The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2023-61644.8The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘new CVE-2023-61654.8The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow CVE-2023-61666.1The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cro CVE-2023-61739.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeoSOFT Software TeoBASE allows SQL In CVE-2023-61746.5SSH dissector crash in Wireshark 4.0.0 to 4.0.10 allows denial of service via packet injection or crafted capture file CVE-2023-61757.8NetScreen file parser crash in Wireshark 4.0.0 to 4.0.10 and 3.6.0 to 3.6.18 allows denial of service via crafted capture file CVE-2023-61764.7A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occu CVE-2023-61786.5An arbitrary file write vulnerability exists where an authenticated attacker with privileges on the managing application could alter Nessus CVE-2023-61797.8Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s). A(n) att CVE-2023-61805.3The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential D