The WPFunnels Creator LMS plugin contains an incorrect privilege assignment bug that permits a user with lower permissions to elevate their role to administrator. This flaw enables an attacker to fully control the WordPress site, including changing settings, managing users, and publishing malicious content, thereby compromising confidentiality, integrity, and availability.

The vulnerability affects the WordPress plugin WPFunnels Creator LMS for all releases up to version 1.1.18. Earlier releases are also impacted, as the defect existed from the earliest available version through the listed limit.

The functionality flaw has a high severity rating of 8.8 on a 0‑10 scale, indicating substantial potential damage if exploited. The estimated probability of an exploit being used is less than one percent, and the vulnerability is not listed in the known exploited vulnerabilities catalog. An attacker must be authenticated with a non‑administrative role to use the flaw, after which they can obtain full administrative privileges. The combination of high potential impact and the requirement for user authentication means the threat is moderate to high, especially for sites where low‑level users have unrestricted privileges.