What’s Vulnerable › Vulnerabilities

CVE-2021-24562: LifterLMS < 4.21.2 - Access Other Student Grades/Answers via IDOR

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-08-23 · updated 2026-06-17
• Weakness: CWE-639

Description

The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers and grades

Affected products

• chrisbadgett LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: before 4.21.2 — fixed in 4.21.2

How to fix

Upgrade to a fixed version: chrisbadgett LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes 4.21.2. Check the vendor advisory for mitigations.

References

• https://make.lifterlms.com/2021/05/17/lifterlms-version-4-21-2/
• https://wpscan.com/vulnerability/d45bb744-4a0d-4af0-aa16-71f7e3ea6e00
• https://make.lifterlms.com/2021/05/17/lifterlms-version-4-21-2/
• https://wpscan.com/vulnerability/d45bb744-4a0d-4af0-aa16-71f7e3ea6e00

Get alerted when CVE-2021-24562 or the next vulnerability affects your stack