Contributor Arbitrary File Upload in Creator LMS

Executive Summary

This vulnerability is an Arbitrary File Upload flaw in the WordPress Creator LMS Plugin versions 1.2.21 and below. It allows users with contributor or similar roles to upload malicious files to the server, potentially leading to a full system takeover.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file uploads in the Creator LMS plugin directory, particularly files with unexpected extensions or in unusual locations. Review server logs for POST requests to upload endpoints. Use tools like grep to search for suspicious file types or paths in the plugin's upload directories.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to upload harmful files, gaining control of your website. This may result in data theft, malware distribution, or complete site compromise. The high CVSS score (9.9) indicates severe risk.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Creator LMS plugin to version 1.2.22 or later immediately. If updating is not possible, apply mitigations such as vulnerability-specific rules or enable auto-updates. Restrict file upload permissions to trusted users only and monitor for unauthorized file changes.

Useful 0 Not Useful 0