published September 10, 2019
⚠️ A sneaky options import vulnerability in the LifterLMS plugin could let anyone create an admin account! This exploit might be hiding in plain sight on your WordPress site. 🔍 Think of it like a restaurant where anyone can sneak into the kitchen and order whatever they want, without even showing a reservation — it’s a recipe for chaos! 🍽️ An attacker could waltz in and create a new administrator account, gaining full control over your site. This could lead to website redirection, exposing users to malicious content, and even stored cross-site scripting (XSS) vulnerabilities. Your site could be turned into a playground for bad actors!
Think of it like a restaurant where anyone can sneak into the kitchen and order whatever they want, without even showing a reservation — it’s a recipe for chaos! 🍽️ The vulnerability stems from the upload_import function in the class.llms.admin.import.php script, allowing unauthenticated users to import options that shouldn't be accessible without proper privileges.
An attacker could waltz in and create a new administrator account, gaining full control over your site. This could lead to website redirection, exposing users to malicious content, and even stored cross-site scripting (XSS) vulnerabilities. Your site could be turned into a playground for bad actors! Immediately update the LifterLMS plugin to version 3.34.6 or later to patch this vulnerability. Ensure you audit your user accounts for any unauthorized admin accounts that may have been created. Keep your WordPress security measures sharp! 🔒 You've got this! With a quick update and a solid audit, your site will be back in safe hands in no time! 🛡️