The LifterLMS WordPress plugin prior to version 10.0.10 contains an information exposure vulnerability (CWE-200) due to insufficient capability checks in a select2 query AJAX handler. The handler verifies only that the user is authenticated but does not check for appropriate permissions, enabling any logged-in user with subscriber-level access to retrieve titles of internal post types, including sensitive data like coupon codes. This could lead to unauthorized disclosure of internal information.

An attacker with subscriber-level access can obtain titles of internal post types such as coupon codes, potentially exposing sensitive information. The vulnerability does not allow modification or deletion of data, nor does it affect availability. The impact is limited to information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for unusual access patterns to internal post types. Avoid exposing sensitive internal post types to low-privilege users.