CVE-2026-97244
HighCVSS 7.5Summary
The Creator LMS plugin in versions up to and including 1.2.19 contains a Path Traversal vulnerability exploitable by a user with Contributor privileges.
Risk Assessment
A Contributor-level user can access files outside the intended directory, potentially leading to disclosure of sensitive information.
Recommendation
Update the Creator LMS plugin to a version later than 1.2.19 or restrict Contributor user privileges.
Other vulnerabilities in Creator LMS
See all- CVE-2026-62083Medium
Creator LMS plugin version 1.2.19 and earlier contains an 'Other Vulnerability Type' vulnerability exploitable by subscribers, allowing unauthorized actions.
- CVE-2025-69359Medium
The Creator LMS plugin (WPFunnels) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects Creator LMS from n/a through version 1.1.12.
Original NVD description (English source)
Contributor Path Traversal in Creator LMS <= 1.2.19 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS