The Creator LMS plugin for WordPress contains a flaw described as an “Other vulnerability Type” applicable to all releases up through 1.2.19. The advisory labels the issue as a subscriber‑level problem, which implies that a user interacting with the subscription or enrollment features could trigger it. With a CVSS score of 5.4, the severity is deemed moderate, but the description does not specify the exact function that is compromised. Based on the information provided, the vulnerability could allow an attacker with subscriber privileges to gain unauthorized access or elevate their permissions within the plugin’s domain.

The affected software is the WordPress Creator LMS plugin distributed by WPFunnels. Any installation running a version older than 1.2.20 is potentially vulnerable. The advisory does not list individual sub‑versions beyond the cutoff; therefore, all revisions up to and including 1.2.19 are considered at risk.

The CVSS score of 5.4 indicates moderate severity, while no EPSS score is available, so the current exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The attack vector is not explicitly defined, but it is inferred that the vulnerability may require authenticated or local access through the WordPress installation. Defenders should treat the flaw as potentially exploitable against any site that has the vulnerable plugin installed until a patch is applied.