CVE-2025-69359
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Creator LMS plugin (WPFunnels) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects Creator LMS from n/a through version 1.1.12.
Risk Assessment
The risk involves potential unauthorized access to administrative functions or data, which could lead to compromise of system integrity and confidentiality.
Recommendation
Update the Creator LMS plugin to a version newer than 1.1.12 and review access control configuration.
Other vulnerabilities in Creator LMS
See all- CVE-2026-97244High
The Creator LMS plugin in versions up to and including 1.2.19 contains a Path Traversal vulnerability exploitable by a user with Contributor privileges.
- CVE-2026-62083Medium
Creator LMS plugin version 1.2.19 and earlier contains an 'Other Vulnerability Type' vulnerability exploitable by subscribers, allowing unauthorized actions.
Original NVD description (English source)
Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through <= 1.1.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS