Wpfunnels CVE-2026-32530

Authenticated user account in WPFunnels Creator LMS version 1.1.18 and earlier. Attacker must have valid login credentials to access the platform. No victim interaction or special configuration required beyond standard deployment.

Real-world risk is significant despite missing CVSS and EPSS metrics. The vulnerability affects a popular WordPress LMS plugin with confirmed exploitation vectors reported by Patchstack, a reputable WordPress security researcher. Privilege escalation flaws are consistently ranked as critical by SSVC frameworks because they have a technical impact of total compromise (attackers gain administrative control) and are typically automatable once the privilege-assignment logic is understood. The lack of published CVSS/EPSS data suggests either recent disclosure or vendor embargo; however, the specificity of the version range (through 1.1.18) and formal CVE/EUVD assignment indicate this is a genuine, validated flaw rather than theoretical. For WordPress administrators managing educational platforms, this warrants immediate patching due to the high value of LMS installations (student records, credentials, course content). The plugin's widespread use in WordPress ecosystems elevates risk compared to niche software.

An attacker with a low-privilege user account (e.g., student or instructor role) can manipulate the privilege assignment mechanism in Creator LMS to elevate themselves to administrator, gaining the ability to modify course content, access all student records, create new admin accounts, or exfiltrate sensitive educational data. Because the flaw is in application logic rather than requiring network-level access, it is likely remotely exploitable by any authenticated user without additional complexity; in some cases, unauthenticated privilege assignment errors may also apply. Once elevated, the attacker achieves persistent access and can compromise the entire WordPress installation, including other plugins and the database.