CVE-2025-15347: Creator LMS Privilege Escalation Flaw

CVE-2025-15347 Overview

The Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress contains a critical authorization bypass vulnerability that enables privilege escalation through unauthorized data modification. The vulnerability exists due to a missing capability check in the get_items_permissions_check function in all versions up to and including 1.1.12.

This flaw allows authenticated attackers with contributor-level access or above to update arbitrary WordPress options, potentially leading to complete site compromise through privilege escalation.

Critical Impact

Authenticated attackers with minimal privileges (contributor level) can modify arbitrary WordPress options, enabling full privilege escalation and potential site takeover.

Affected Products

• Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress versions up to and including 1.1.12

Discovery Timeline

• 2026-01-20 - CVE CVE-2025-15347 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-15347

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), a fundamental access control flaw that occurs when an application fails to verify whether a user is authorized to perform a requested action. In the context of WordPress plugins, proper capability checks are essential to ensure that users can only perform actions appropriate to their role.

The Creator LMS plugin's REST API endpoint in the SettingsController.php file contains a get_items_permissions_check function that fails to properly validate whether the requesting user has sufficient privileges to modify WordPress options. This oversight allows any authenticated user with at least contributor-level access to invoke the endpoint and modify sensitive site configuration options.

Root Cause

The root cause is a missing capability check within the get_items_permissions_check function of the plugin's REST API controller. WordPress plugins that expose REST API endpoints must implement proper authorization checks using functions like current_user_can() to verify the requesting user has appropriate capabilities before allowing sensitive operations.

The vulnerable function fails to validate that the user has administrative privileges (such as manage_options capability) before permitting modifications to WordPress options. This architectural oversight in the plugin's access control implementation creates a direct path to privilege escalation.

Attack Vector

The attack is network-based and requires low-privilege authentication (contributor level access). An attacker can exploit this vulnerability by:

1. Authenticating to the WordPress site with a contributor-level or higher account
2. Crafting a malicious REST API request to the vulnerable endpoint
3. Modifying critical WordPress options such as user roles or site configuration
4. Escalating privileges to administrator level by manipulating the default_role option or directly modifying user capabilities

The vulnerability can be exploited remotely over the network without any user interaction, and the attacker only needs basic authentication credentials to mount the attack. For technical details on the vulnerable code path, refer to the WordPress Plugin Changeset.

Detection Methods for CVE-2025-15347

Indicators of Compromise

• Unexpected changes to WordPress site options, particularly default_role, users_can_register, or admin email settings
• REST API requests to Creator LMS settings endpoints from non-administrative user accounts
• Sudden privilege changes for existing user accounts, especially contributors being elevated to administrators
• Unauthorized new administrator accounts appearing in the WordPress user database

Detection Strategies

• Monitor WordPress REST API logs for unusual requests to /wp-json/creatorlms/ endpoints from low-privilege users
• Implement file integrity monitoring on WordPress wp_options table to detect unauthorized modifications
• Review WordPress audit logs for option changes made outside of the admin dashboard
• Deploy web application firewall (WAF) rules to detect and block suspicious REST API option modification attempts

Monitoring Recommendations

• Enable comprehensive logging for all WordPress REST API requests, including authentication context
• Configure alerts for any modification to critical WordPress options from non-administrator sessions
• Regularly audit user role assignments to detect unauthorized privilege escalation
• Monitor plugin activity logs for anomalous settings changes within the Creator LMS plugin

How to Mitigate CVE-2025-15347

Immediate Actions Required

• Update the Creator LMS plugin to version 1.1.13 or later immediately
• Audit all WordPress user accounts for unexpected privilege changes or unauthorized administrators
• Review WordPress options table for any unauthorized modifications to site configuration
• Consider temporarily deactivating the plugin if immediate update is not possible

Patch Information

The vulnerability has been addressed in Creator LMS version 1.1.13. The fix implements proper capability checks in the get_items_permissions_check function within SettingsController.php. Site administrators should update through the WordPress plugin dashboard or download the patched version directly from the WordPress plugin repository.

For details on the specific code changes, see the WordPress Plugin Changeset. Additional vulnerability information is available in the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the Creator LMS plugin until the update can be applied
• Restrict contributor and author user registrations until the patch is deployed
• Implement a web application firewall rule to block REST API requests to Creator LMS settings endpoints from non-admin users
• Remove or demote any unnecessary contributor-level accounts to reduce the attack surface

# Verify current plugin version via WP-CLI
wp plugin list --name=creatorlms --fields=name,version,status

# Update to patched version
wp plugin update creatorlms

# Audit user roles for unexpected administrators
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered