EUVD-2026-89821
GHSA-q5q4-c7v6-r6xm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or use Subscriber account
-
ExploitSend request with malformed input value
-
ExecutionBypass improper input validation
-
ImpactObtain limited data disclosure or minor tampering
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Input size validation
|
| Exploitation Conditions | Requires an authenticated WordPress account at Subscriber level or higher on a site running the Creator LMS plugin version 1.2.19 or earlier (PR:L). Exploitation is network-reachable with low complexity and no user interaction, but is limited by the authentication requirement and by the bounded impact (low confidentiality and low integrity only, no availability effect). On sites where open user registration is enabled, the Subscriber prerequisite is trivially met; on sites without registration, an attacker must first obtain valid low-privilege credentials. |
| Impact | This is a genuinely low-priority issue despite the MEDIUM 5.4 CVSS. The vendor (Patchstack) CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N describes network-reachable, low-complexity exploitation but requires authenticated Subscriber-level privileges (PR:L) and yields only low confidentiality and low integrity impact with no availability effect - consistent with CWE-1284 (improper validation of specified quantity in input). No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation. The description is extremely sparse ('Subscriber Other Vulnerability Type'), naming no parameter, endpoint, or sink, which caps confidence in the exact mechanism; however the bounded impact (C:L/I:L only) and the authenticated-Subscriber precondition make this a routine hygiene patch rather than an urgent one. Note the 'Information Disclosure' tag is only partially accurate: the vector includes I:L, so this is not purely a disclosure issue but also permits limited tampering. |
| Exploit ScenarioDerived | An attacker who holds (or self-registers for) a Subscriber account on a WordPress site running Creator LMS <= 1.2.19 submits a request with malformed or out-of-range input to a plugin endpoint that fails to validate the specified quantity/value, causing limited disclosure of data and/or minor unauthorized modification. No public exploit code is identified at time of analysis, and exploitation is bounded to low-impact effects rather than full account or site takeover. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
WordPress sites running the WPFunnels Creator LMS plugin at version 1.2.19 or earlier expose an authenticated manipulation and disclosure weakness, where improper validation of a specified quantity value lets an attacker with a Subscriber-level account or higher read limited data and alter limited plugin content (CVSS 5.4, C:L/I:L/A:N). Exploitation is network-reachable, low complexity, and requires no victim interaction, but remains gated behind the low-privilege login prerequisite, which is trivial to satisfy on sites with open user registration. No public exploit code and no confirmed active exploitation were identified at time of analysis, and this is assessed as a genuinely low-priority issue despite the MEDIUM base score.
RemediationAI
No vendor-released patch was identified at time of analysis; version 1.2.19 is the latest confirmed affected release, so administrators should monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/creatorlms/vulnerability/wordpress-creator-lms-plugin-1-2-19-other-vulnerability-type-vulnerability?_s_id=cve and the WPFunnels plugin page for a fixed version and upgrade as soon as one is published. Until a fix ships, the most effective compensating control is closing the low-privilege foothold: disable open user registration or restrict new account creation to manually approved roles, with the trade-off that legitimate self-enrollment for courses is blocked or must be handled administratively. Tightening the Subscriber role's capabilities on the LMS site, or removing dormant Subscriber accounts, reduces the attack surface at the cost of added account-management overhead. Deploying a virtual patching or WAF rule set that blocks malformed quantity parameters on the Creator LMS REST/admin endpoints offers interim protection but can cause false positives on legitimate course and enrollment operations and should be tested before enforcement. If the plugin cannot be updated or constrained, deactivating Creator LMS removes the exposure entirely at the cost of losing its LMS functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is classified under CWE-1284 (Improper Validation of Specified Quantity in Input), a root-cause class in which a value representing an amount, count, or quantity is accepted from user input without proper range, type, or sanity checking before being used by application logic. In a WordPress LMS plugin such as Creator LMS, quantity-type parameters typically appear in enrollment, course/lesson capacity, ordering, or progress-tracking features, and unvalidated values can let a low-privileged user influence backend data handling and observe responses that were not intended for their role, producing the low confidentiality and low integrity impact reflected in the assessed vector. The affected component is identified by the CPE cpe:2.3:a:wpfunnels:creator_lms:*:*:*:*:*:*:*:*, which resolves to the WordPress plugin namespace distributed by WPFunnels; the vulnerability is plugin-level and lives in the PHP code executed inside the hosting WordPress installation rather than in WordPress core. The report originates from Patchstack's WordPress vulnerability database, and no CWE-adjacent memory-safety, injection, or remote code execution behavior is indicated by the available data.
Know when Creator Lms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable, low-complexity flaw requiring a Subscriber account (PR:L) with no user interaction; improper input validation yields only limited disclosure and tampering (C:L/I:L, A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Creator Lms
View allArbitrary file upload in the WordPress plugin Creator LMS (by WPFunnels) versions 1.2.21 and earlier lets an authenticat
An Incorrect Privilege Assignment vulnerability exists in WPFunnels Creator LMS plugin (versions up to and including 1.1
Authenticated path traversal in the WordPress Creator LMS plugin (WPFunnels) affects all versions up to and including 1.
Exploit-DB