PT-2026-3572 · WordPress · Wordpress+1

Sarawut Poolkhet · Published 2026-01-20 · Updated 2026-01-20 · CVE-2025-15347

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress versions up to and including 1.1.12

Description The Creator LMS plugin for WordPress is susceptible to unauthorized data modification, potentially leading to privilege escalation. An attacker with contributor-level access or higher can update arbitrary WordPress options due to a missing capability check within the get items permissions check function.

Recommendations Update to version 1.1.13 or later.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-15347

Affected Products

Creator Lms

Wordpress

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-15347 · Security Note
• https://twitter.com/TheHackerWire/status/2013660621955584320 · Twitter Post
• https://twitter.com/CVEnew/status/2013625623873564989 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3433193/creatorlms/tags/1.1.13/includes/Rest/V1/SettingsController.php · Note
• https://twitter.com/CveFindCom/status/2013637548812243175 · Twitter Post
• https://t.me/CVEtracker/42629 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4bddaefc-9ddc-4798-acb6-7b87f7c924a1?source=cve · Note