CVE-2026-62129: WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability
Published Oct 10, 2026
·Updated
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
Affected Software
1 affected component
WordPress Creator LMS plugin<=1.2.21
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Creator LMS pluginto a version that resolves this vulnerability.Fixed in 1.2.22
Event History
Oct 10, 2026
CVE Published
via MITRE·07:36 PM
Data Sourced
via MITRE·07:36 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs Contributor-level access to a WordPress site running the affected plugin. No user interaction is required, and the vulnerability is network-accessible.
2
What is the potential impact of successful exploitation?
A Contributor can upload arbitrary files, with potential impact to confidentiality, integrity, and availability rated high. The scope may extend beyond the vulnerable plugin.
3
Which versions are affected?
Creator LMS versions up to and including 1.2.21 are affected.