Creator LMS EUVD-2026-94959

Exploitation requires only that a vulnerable Creator LMS plugin (version up to and including 1.2.21) be installed and network-reachable on a WordPress site; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special configuration is needed, so default installations are affected. The limiting factors are scope and impact rather than access: the flaw yields only a partial integrity impact (I:L, with C:N/A:N), meaning an attacker can trigger an unauthorized plugin action but cannot read protected data or disrupt availability through this issue alone, and exploitation is confined to environments actually running this specific LMS plugin.

This is a moderate-severity Missing Authorization flaw (CWE-862) with a provided CVSS 3.1 base score of 5.3 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating a network-reachable, low-complexity, unauthenticated issue whose only impact is a limited integrity loss (C:N/I:L/A:N). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals that would normally elevate a broken-access-control bug to urgent priority are all absent or unknown. The practical risk is best characterized as low-to-moderate: an unauthenticated attacker can likely invoke a restricted plugin action to make unauthorized changes, but with no confidentiality or availability impact and only partial integrity impact, this is a data-integrity/abuse concern rather than a full compromise. The CVSS vector and the 'Authentication Bypass'/'broken access control' tags are consistent, so there is no internal conflict to flag; the main missing data points are EPSS probability and any independent confirmation of affected-version boundaries beyond Patchstack's advisory.

An unauthenticated attacker sends a crafted HTTP request directly to a Creator LMS plugin endpoint (e.g. an AJAX or REST action) that fails to verify the caller's authorization, performing an operation that should be restricted to privileged users. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing is required, but the impact is limited to unauthorized modification of plugin-managed data (I:L). No public exploit code was identified at time of analysis.