CVE-2026-14231 is an information exposure vulnerability (CWE-200) in the LifterLMS WordPress plugin prior to version 10.0.10. The vulnerability arises because one of the select2 query AJAX handlers only verifies that the user is logged in but does not perform a capability check. Consequently, authenticated users with minimal privileges (subscriber-level) can access the titles of internal post types, including sensitive data like coupon codes, by supplying the post type parameter in the AJAX request.

Authenticated users with subscriber-level access can read titles of internal post types that should be restricted, such as coupon codes. This exposure could lead to unauthorized disclosure of sensitive information within the WordPress environment. There is no indication of remote code execution or privilege escalation, but the information leak could aid further attacks or unauthorized use of coupon codes.

No official patch or remediation guidance is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting subscriber-level access or disabling the affected AJAX handler if feasible.