The vulnerability arises from missing authorization checks within the Creator LMS plugin, allowing actors to exploit incorrectly configured access control levels. Attackers can read or alter content that should be protected, such as course materials, user progress, or administrative settings. This weakness aligns with CWE-862, an Authorization Bypass.

The issue affects the WordPress plugin Creator LMS from the WPFunnels vendor. All versions from the initial release up to and including 1.1.12 are impacted. Site owners using any of these releases are vulnerable.

The CVSS score of 5.3 marks it as a moderate severity flaw. The EPSS score is below 1%, indicating a low likelihood of exploitation, and it is not listed in the CISA KEV catalog. Likely exploitation occurs via the web interface of the plugin, potentially requiring authenticated or unauthenticated access depending on the site’s configuration.