CVE-2026-62128: WordPress Creator LMS plugin <= 1.2.21 - Broken Access Control vulnerability
Missing Authorization vulnerability in Creator LMS Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through 1.2.21.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Creator LMS pluginto a version that resolves this vulnerability.Fixed in 1.2.22
Event History
Frequently Asked Questions
Which Creator LMS versions are affected?
The issue affects Creator LMS through version 1.2.21. The available data does not identify a fixed version.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates that exploitation can be performed remotely without privileges or user interaction, and has low attack complexity.
What is the expected impact if exploited?
The reported impact is limited to integrity, meaning an attacker may be able to modify data or perform unauthorized actions. No confidentiality or availability impact is indicated.