PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-62129 WPFunnels CVE debrief

CVE-2026-62129 Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions. This critical vulnerability allows contributors to upload arbitrary files, potentially leading to system compromise or data breaches. Defenders and administrators of Creator LMS installations should assess exposure and take action immediately. The CVE record and NVD entry provide limited information about the vulnerability, emphasizing the need

Vendor
WPFunnels
Product
Creator LMS
CVSS
CRITICAL 9.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-10
Original CVE updated
2026-10-10
Advisory published
2026-10-10
Advisory updated
2026-10-10

Who should care

Defenders and administrators of Creator LMS installations should assess exposure and take action.

Why it matters

Defenders should prioritize verifying exposure and assessing potential impact due to the critical vulnerability in Creator LMS.

  • Potential unauthorized file uploads
  • Possible system compromise or data breaches
  • Required verification of Creator LMS version and exposure

Technical summary

The Creator LMS plugin has a critical vulnerability allowing contributors to upload arbitrary files without proper validation or restrictions. This could lead to potential unauthorized file uploads, possible system compromise or data breaches, and required verification of Creator LMS version and exposure. The vulnerability's impact is critical, with a CVSS score of 9.9, and it

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact.

Recommended defensive actions

  • Verify Creator LMS version and assess exposure
  • Review and restrict contributor upload permissions
  • Monitor for suspicious file uploads and system changes

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-62129 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-62129

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-62129 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-62129

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.