CVE-2025-15347

Creator LMS – The LMS for Creators, Coaches, and Trainers <= 1.1.12 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update

View on CVE.org

Published Jan 20, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

The Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check in the get_items_permissions_check function in all versions up to, and including, 1.1.12. This makes it possible for authenticated attackers, with contributor level access and above, to update arbitrary WordPress options.

Analysis

Technical impact

The vulnerability lies in a missing capability check in the get_items_permissions_check function of the Creator LMS plugin. This oversight allows an authenticated user with contributor‑level access or higher to modify any WordPress option stored by the plugin, resulting in privilege escalation that can compromise site integrity. This flaw is identified as CWE‑862, Missing Authorization.

Affected Systems

All releases of the Creator LMS plugin identified as getwpfunnels:Creator LMS – Online Courses and eLearning Plugin, up to and including version 1.1.12, are affected on WordPress installations that have contributors or higher users. Earlier versions that include the missing check or that are beyond 1.1.12 are not vulnerable.

Risk and Exploitability

The CVSS score of 8.8 categorizes this defect as High severity. The EPSS score of < 1% suggests that active exploitation in the wild is currently very low, and it is not listed in CISA’s KEV catalog. However, because the threat requires only authenticated contributor‑level access—which is commonly available on many public WordPress sites—a determined attacker could quickly modify settings once the plugin is installed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

getwpfunnels

Creator LMS – Online Courses and eLearning Plugin

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.1.12

No data.

Vendor	Product	Versions
Getwpfunnels	Creator Lms	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Creator LMS plugin to version 1.1.13 or newer, which implements the missing capability check in get_items_permissions_check.
After updating, remove or limit contributor‑level accounts on the WordPress site unless they are strictly needed.
As a temporary defensive measure, restrict the REST API endpoints that expose the settings update functionality to administrators only, using a firewall rule or .htaccess restriction.

Generated by OpenCVE AI on April 20, 2026 at 15:57 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.316% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://plugins.trac.wordpress.org/changeset/3433193/creatorlms/tags/1.1.13/includes/Rest/V1/SettingsController.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/4bddaefc-9ddc-4798-acb6-7b87f7c924a1?source=cve

History

Jan 21, 2026 11:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Getwpfunnels Getwpfunnels creator Lms Wordpress Wordpress wordpress
Vendors & Products		Getwpfunnels Getwpfunnels creator Lms Wordpress Wordpress wordpress

Jan 20, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jan 20, 2026 2:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check in the get_items_permissions_check function in all versions up to, and including, 1.1.12. This makes it possible for authenticated attackers, with contributor level access and above, to update arbitrary WordPress options.
Title		Creator LMS – The LMS for Creators, Coaches, and Trainers <= 1.1.12 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/changeset/3433193/creatorlms/tags/1.1.13/includes/Rest/V1/SettingsController.php https://www.wordfence.com/threat-intel/vulnerabilities/id/4bddaefc-9ddc-4798-acb6-7b87f7c924a1?source=cve
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`