PT-2026-3572 · WordPress · Wordpress+1

Sarawut Poolkhet · Publicado 2026-01-20 · Atualizado 2026-01-20 · CVE-2025-15347

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress versions up to and including 1.1.12

Description The Creator LMS plugin for WordPress is susceptible to unauthorized data modification, potentially leading to privilege escalation. An attacker with contributor-level access or higher can update arbitrary WordPress options due to a missing capability check within the get items permissions check function.

Recommendations Update to version 1.1.13 or later.

Correção

LPE

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-15347

Produtos afetados

Creator Lms

Wordpress

Referências · 7

• https://twitter.com/TheHackerWire/status/2013660621955584320 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2013625623873564989 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3433193/creatorlms/tags/1.1.13/includes/Rest/V1/SettingsController.php · Nota
• https://twitter.com/CveFindCom/status/2013637548812243175 · Publicação no Twitter
• https://t.me/CVEtracker/42629 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-15347 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/4bddaefc-9ddc-4798-acb6-7b87f7c924a1?source=cve · Nota