The vulnerability is a contributor‑level path traversal flaw in WordPress Creator LMS plugin versions up to 1.2.19, enabling an attacker who has contributor permissions to craft file paths that step outside the intended directory. This allows the attacker to read arbitrary files on the server, potentially exposing sensitive configuration, authentication tokens, or application code. The integrity of the file system is also at risk if the flaw could be extended to write files, although the description focuses on traversal for reading.

WordPress sites that use the WPFunnels Creator LMS plugin with a version of 1.2.19 or earlier are affected. The plugin is a WordPress plugin and must be running within a WordPress installation on a web server that hosts the WordPress site.

The CVSS score of 7.5 places the issue in the high‑severity range, indicating significant potential impact. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. It is inferred that the attacker requires contributor access to the site, which is a privilege that is commonly granted but may be restricted. Given the high CVSS score and the facilitation of arbitrary file disclosure, the vulnerability warrants prompt remediation.