Creator LMS CVE-2026-62129

Requires the Creator LMS plugin (by WPFunnels) installed and active at version 1.2.21 or earlier, plus an authenticated account with at least Contributor privileges (CVSS PR:L) - the attacker abuses the plugin's file upload feature to place an executable (e.g., PHP) file without adequate type validation. Limiting factors: exploitation is gated on obtaining a Contributor-or-higher account, so sites that disable open user registration and tightly control author/contributor roles substantially reduce exposure; sites with open registration or many low-trust contributors are at materially higher risk. No user interaction and no admin access are needed once a Contributor account is held.

Signals align toward a genuine high priority, with one notable gap. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, C:H/I:H/A:H → 9.9) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with a scope change and total impact across confidentiality, integrity and availability - consistent with CWE-434 unrestricted file upload leading to code execution. The 'Contributor' qualifier in the title corroborates PR:L: a low-trust authenticated role is the barrier, not full admin. No EPSS score was provided in the input, so exploitation probability cannot be weighed. KEV status is not indicated (not listed), so there is no confirmed active exploitation, and no POC was referenced, so exploit maturity is unknown. No SSVC decision data was supplied. Net: this is a real, high-severity issue for any site running the affected plugin where contributor-or-higher accounts can be obtained (e.g., open registration or multi-author sites), but the absence of EPSS/KEV/POC signals means there is no evidence of widespread opportunistic exploitation yet - treat as patch-urgently rather than emergency-in-the-wild. The sole dependency on an authenticated contributor account is the key factor distinguishing this from a fully unauthenticated 10.0.

An attacker obtains or registers a low-privileged Contributor account on a WordPress site running Creator LMS <= 1.2.21, then abuses the plugin's file upload handling to upload a malicious PHP file (web shell) that bypasses type restrictions. Requesting the uploaded file executes attacker code in the web server context, yielding full site compromise. No public exploit was identified at time of analysis, so exploitation currently requires developing the upload technique independently.