CVE-2026-62128
MediumCVSS 5.3Summary
A missing authorization vulnerability in Creator LMS allows exploiting incorrectly configured access control security levels. Affects versions from n/a through 1.2.21.
Risk Assessment
An attacker can access functions or data they should not have permission to, potentially leading to confidentiality or integrity breaches.
Recommendation
Update Creator LMS to the latest version that includes the fix.
Other vulnerabilities in Creator LMS
See all- CVE-2026-97244High
The Creator LMS plugin in versions up to and including 1.2.19 contains a Path Traversal vulnerability exploitable by a user with Contributor privileges.
- CVE-2026-62083Medium
Creator LMS plugin version 1.2.19 and earlier contains an 'Other Vulnerability Type' vulnerability exploitable by subscribers, allowing unauthorized actions.
- CVE-2026-62129Critical
Arbitrary file upload vulnerability allowing a Contributor user to upload arbitrary files in the Creator LMS plugin in versions up to and including 1.2.21. A low-privileged user can upload arbitrary files to the server. This may lead to malicious code execution.
- CVE-2025-69359Medium
The Creator LMS plugin (WPFunnels) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects Creator LMS from n/a through version 1.1.12.
Original NVD description (English source)
Missing Authorization vulnerability in Creator LMS Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through 1.2.21.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS