The vulnerability is a missing authorization flaw in the WordPress Creator LMS plugin that enables users to bypass intended access controls. This flaw relies on incorrectly configured security levels and is identified by CWE‑862. Attackers can obtain unauthorized privileged access to the plugin’s administrative functions or data, potentially exposing sensitive course material or user information, but the flaw does not provide remote code execution or direct denial of service.

The affected software is the Creator LMS WordPress plugin, version 1.2.21 and earlier. Only the Creator LMS product is impacted, and the issue exists from the earliest released version through 1.2.21.

The CVSS score of 5.3 reflects moderate impact and the lack of a requirement for user interaction; the EPSS score is not available, suggesting limited publicly known exploit activity, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote via the web interface, where an attacker without proper authentication can manipulate the plugin’s access checks to elevate privileges. While the exploit is relatively simple once the plugin is exposed, the potential to access or modify sensitive data warrants a moderate risk assessment.