Creator LMS EUVD-2026-89908

Requires an authenticated WordPress account with at least Contributor privileges on a site running the Creator LMS plugin version 1.2.19 or earlier (PR:L). Exploitation is remote over the network (AV:N) with no user interaction (UI:N), but attack complexity is rated high (AC:H), indicating the traversal depends on specific, not-guaranteed conditions to succeed reliably. The principal limiting factors are the need for a valid low-privilege account (self-registration must be enabled or the account otherwise obtained) and the elevated complexity, which together narrow this well below an unauthenticated default-configuration attack.

This is a moderate-priority issue that reads higher than its real-world risk. The CVSS 7.5 is inflated primarily by the vendor's full C:H/I:H/A:H triad, but the vulnerability is a CWE-35 path traversal in a WordPress plugin - a class that in practice yields arbitrary file READ (confidentiality), not the write/integrity or availability impact the vector claims. The vector itself carries two meaningful brakes: AC:H (high attack complexity, implying the traversal is not trivially reliable) and PR:L (a valid Contributor-level account is required), so this is not an unauthenticated internet-wide exploit. Exploitation signals are all cold: no EPSS score provided, no CISA KEV listing, and no public POC identified at time of analysis, which is typical for a freshly Patchstack-disclosed WordPress plugin CVE. Weighing these together, the practical risk is a low-to-medium authenticated file-disclosure bug that could leak wp-config.php credentials or other sensitive files, but requires an attacker to already hold a Contributor account and clear a non-trivial exploitation hurdle. Note the impact conflict: vendor scores C:H/I:H/A:H, but a path-traversal read primitive realistically supports C:H with only marginal I/A - verify the actual sink with the vendor advisory before treating this as a write/RCE-adjacent flaw.

An attacker who has registered or obtained a WordPress Contributor account on a site running Creator LMS <= 1.2.19 submits a crafted request to a plugin endpoint containing directory-traversal sequences (e.g. ../../) in a file-path parameter. Because input is not properly canonicalized, the plugin resolves the path outside its intended directory and returns the contents of an arbitrary server file such as wp-config.php, exposing database credentials and secret keys. No public exploit code is currently available, and the CVSS AC:H rating suggests the traversal requires specific conditions to trigger reliably.