Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.21 - Authenticated (Contributor+) Arbitrary File Upload
high
The Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.2.21. This is due to missing file type validation. This makes it possible for authenticated attackers, with contributor-level access and above...
- CVSS:
- 8.8
(Wordfence)
- Affected:
- up to 1.2.21
- Fixed in:
- 1.2.22
- Disclosed:
- Oct 8, 2026
CVE-2026-62129 on NVD →
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.21 - Missing Authorization
medium
The Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.2.21. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized a...
- CVSS:
- 5.3
(Wordfence)
- Affected:
- up to 1.2.21
- Fixed in:
- 1.2.22
- Disclosed:
- Oct 8, 2026
CVE-2026-62128 on NVD →
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.19 - Authenticated (Subscriber+) Free Paid Course Enrollment
medium
The Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 1.2.19. This is due to missing server-side validation of the attacker-supplied `purchase_by` parameter in the cart and checkout flow, allowing the poin...
- CVSS:
- 6.3
(Wordfence)
- Affected:
- up to 1.2.19
- Fixed in:
- 1.2.20
- Disclosed:
- Sep 30, 2026
CVE-2026-62083 on NVD →
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.19 - Authenticated (Contributor+) Path Traversal
medium
The Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.2.19. This is due to insufficient validation of a user supplied path. This makes it possible for authenticated attackers, with contributor-level acce...
- CVSS:
- 6.5
(Wordfence)
- Affected:
- up to 1.2.19
- Fixed in:
- 1.2.20
- Disclosed:
- Sep 29, 2026
CVE-2026-97244 on NVD →
Creator LMS – Online Courses and eLearning Plugin <= 1.1.18 - Authenticated (Contributor+) Privilege Escalation
high
The Creator LMS – Online Courses and eLearning Plugin plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.18. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to that of an administrator.
- CVSS:
- 8.8
(Wordfence)
- Affected:
- up to 1.1.18
- Fixed in:
- 1.1.19
- Disclosed:
- Mar 20, 2026
CVE-2026-32530 on NVD →
Creator LMS – The LMS for Creators, Coaches, and Trainers <= 1.1.12 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update
high
The Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check in the get_items_permissions_check function in all versions up to, and including, 1.1.12. This makes it possible f...
- CVSS:
- 8.8
(Wordfence)
- Affected:
- up to 1.1.12
- Fixed in:
- 1.1.13
- Disclosed:
- Jan 20, 2026
CVE-2025-15347 on NVD →
Creator LMS <= 1.1.12 - Missing Authorization
medium
The Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.1.12. This makes it possible for unauthenticated attackers to perform an unauthorized action.
- CVSS:
- 5.3
(Wordfence)
- Affected:
- up to 1.1.12
- Fixed in:
- 1.1.13
- Disclosed:
- Jan 10, 2026
CVE-2025-69359 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database