CVE-2026-62128 Creator LMS CVE debrief

Who should care

Defenders responsible for WordPress installations with the Creator LMS plugin should assess their exposure and verify the configuration of access control security levels in the plugin. They should also ensure that the plugin is properly updated to a version that addresses this vulnerability.

Why it matters

The CVE-2026-62128 vulnerability is a Missing Authorization issue in the Creator LMS plugin for WordPress, affecting versions up to 1.2.21. Defenders responsible for WordPress installations with the Creator LMS plugin should assess their exposure and verify the configuration of access control security levels in the plugin. The CVSS score for this vulnerability is 5.3, indicating a medium severity level.

• Defenders need to verify the configuration of access control security levels in the Creator LMS plugin to prevent potential exploitation.
• Defenders should ensure that the Creator LMS plugin is updated to a version that addresses this vulnerability to prevent potential exploitation.
• Defenders should monitor for potential exploitation attempts to detect potential security incidents.

Technical summary

The CVE-2026-62128 vulnerability is a Missing Authorization issue in the Creator LMS plugin for WordPress, affecting versions up to 1.2.21. This vulnerability allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized access or modifications.

Defensive priority

Defenders should prioritize verifying the configuration of access control security levels in the Creator LMS plugin and ensure that it is properly updated to a version that addresses this vulnerability.

Recommended defensive actions

• Verify the configuration of access control security levels in the Creator LMS plugin
• Ensure the Creator LMS plugin is updated to a version that addresses this vulnerability
• Monitor for potential exploitation attempts

Evidence notes

The evidence for this vulnerability comes from the CVE Program record and the NVD vulnerability detail page. The CVE Program record provides metadata about the vulnerability, while the NVD page offers a detailed assessment of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.