PHP Object Injection in LifterLMS WordPress Plugin

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only exploitable during lesson creation when a temporary lesson ID triggers the custom metadata path, and requires the attacker to hold a role with the edit_course capability, such as Instructor, Instructor's Assistant, LMS Manager

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

LifterLMS, a popular WordPress LMS plugin for e-learning and online courses, contains a critical PHP Object Injection vulnerability (CVE-2026-104723, CVSS 8.8) affecting all versions up to 10.2.1. The vulnerability stems from unsafe deserialization of untrusted input, allowing authenticated attackers with custom-level access or higher to inject malicious PHP objects. While the plugin itself contains no known gadget chain, the presence of this vulnerability creates a significant risk in environments where complementary plugins or themes with PHP Object Graph (POP) chains are installed, potentially enabling remote code execution and full system compromise.

Casky's 447 matching security skills leverage Claude AI's extended reasoning to detect the attack patterns underlying this vulnerability across the MITRE ATT&CK lifecycle. Practitioners will observe detection coverage for TA0001 (Reconnaissance) techniques identifying plugin enumeration and version fingerprinting, TA0043 (Reconnaissance) for information gathering on installed themes and plugins, and TA0002 (Resource Development) capturing the crafting of serialized payloads. The platform's skills map deserialization attacks to object injection patterns, allowing security teams to identify suspicious unserialize() calls, unusual object instantiation chains, and gadget chain exploitation attempts. Practitioners querying Casky will receive specific indicators—including malicious serialized PHP objects in request parameters, unexpected class instantiation sequences, and cross-plugin dependency chains—enabling rapid threat hunting and vulnerability assessment before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-104723.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-104723

Casky has 447 skills that investigate the attack patterns behind CVE-2026-104723. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn