CVE-2026-62129: WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability

Q: Who can exploit this issue?

An attacker needs Contributor-level access to a WordPress site running the affected plugin. No user interaction is required, and the vulnerability is network-accessible.

Q: What is the potential impact of successful exploitation?

A Contributor can upload arbitrary files, with potential impact to confidentiality, integrity, and availability rated high. The scope may extend beyond the vulnerable plugin.

Q: Which versions are affected?

Creator LMS versions up to and including 1.2.21 are affected.

Published Oct 10, 2026

Updated

Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.

Affected Software

1 affected component

WordPress Creator LMS plugin<=1.2.21

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Creator LMS plugin to a version that resolves this vulnerability.
Fixed in 1.2.22

Event History

Oct 10, 2026

CVE Published

via MITRE·07:36 PM

Data Sourced

via MITRE·07:36 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs Contributor-level access to a WordPress site running the affected plugin. No user interaction is required, and the vulnerability is network-accessible.

What is the potential impact of successful exploitation?

A Contributor can upload arbitrary files, with potential impact to confidentiality, integrity, and availability rated high. The scope may extend beyond the vulnerable plugin.

Which versions are affected?

Creator LMS versions up to and including 1.2.21 are affected.

CVE-2026-62129: WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact of successful exploitation?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact of successful exploitation?

Which versions are affected?