VULNERABILITY INTELLIGENCE

CVE-2019-15896

CVSS score9.8 CRITICAL

EPSS probability6.49%

CISA KEVNot currently listed

Published2019-09-10

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to an unauthenticated options import vulnerability that could lead to privilege escalation (administrator account creation), website redirection, and stored XSS.

Weakness classification

nvd@nist.gov: CWE-306

Primary references

cve@mitre.org — Exploit, Third Party Advisory
cve@mitre.org — Release Notes
cve@mitre.org — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory