CVE-2025-69359: Creator LMS Auth Bypass Vulnerability

CVE-2025-69359 Overview

A Missing Authorization vulnerability has been identified in the WPFunnels Creator LMS WordPress plugin (creatorlms). This broken access control flaw allows attackers to exploit incorrectly configured access control security levels, potentially enabling unauthorized access to protected functionality and data within affected WordPress installations.

Critical Impact

Unauthorized users may be able to bypass access controls and perform actions they should not have permission to execute, potentially compromising course content, user data, or administrative functions within the Creator LMS plugin.

Affected Products

• WPFunnels Creator LMS WordPress Plugin versions up to and including 1.1.12
• WordPress sites running vulnerable versions of the creatorlms plugin

Discovery Timeline

• 2026-01-06 - CVE CVE-2025-69359 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-69359

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), which occurs when software does not perform proper authorization checks before allowing access to functionality or resources. In the context of the Creator LMS plugin, certain endpoints or functions lack the necessary permission validation, allowing unauthorized users to access restricted features.

Missing authorization vulnerabilities in WordPress plugins are particularly dangerous because they can allow unauthenticated or low-privileged users to perform administrative actions, access sensitive course content, modify user enrollments, or extract protected data. The broken access control mechanism fails to verify that the requesting user has the appropriate capabilities before processing requests.

Root Cause

The root cause of this vulnerability stems from improper access control implementation within the Creator LMS plugin. The plugin fails to implement adequate authorization checks (such as WordPress capability checks using current_user_can()) before executing sensitive operations. This architectural oversight allows requests to bypass the intended access control mechanisms.

Attack Vector

An attacker can exploit this vulnerability by sending crafted requests to vulnerable endpoints within the Creator LMS plugin. Since the authorization checks are missing or improperly configured, the attacker does not need elevated privileges to access protected functionality.

The exploitation typically involves:

1. Identifying vulnerable AJAX handlers or REST API endpoints within the plugin
2. Crafting requests that directly access these endpoints without proper authentication
3. Bypassing role-based access controls to perform unauthorized actions

For detailed technical information about this vulnerability, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-69359

Indicators of Compromise

• Unexpected changes to course content, enrollments, or LMS settings without corresponding administrator activity
• Unusual API requests or AJAX calls to Creator LMS plugin endpoints from unauthenticated or low-privileged sessions
• Log entries showing access to administrative LMS functions by non-administrative users
• Unauthorized modifications to user course progress or completion records

Detection Strategies

• Monitor WordPress access logs for suspicious requests targeting /wp-admin/admin-ajax.php with creatorlms-related action parameters
• Implement web application firewall (WAF) rules to detect and block unauthorized access attempts to protected LMS endpoints
• Review user activity logs for privilege escalation patterns or unexpected administrative actions
• Deploy endpoint detection solutions to identify exploitation attempts against WordPress installations

Monitoring Recommendations

• Enable verbose logging for the Creator LMS plugin and review logs regularly for anomalous behavior
• Configure alerts for bulk modifications to course data or user enrollments
• Monitor for new user registrations followed by immediate access to restricted content
• Implement real-time file integrity monitoring on WordPress core and plugin directories

How to Mitigate CVE-2025-69359

Immediate Actions Required

• Update the Creator LMS plugin to a version newer than 1.1.12 that addresses this vulnerability as soon as a patch becomes available
• Audit user accounts and roles for any signs of unauthorized privilege escalation
• Review recent changes to courses, enrollments, and LMS settings for unauthorized modifications
• Consider temporarily disabling the Creator LMS plugin if a patch is not yet available and the functionality is not critical

Patch Information

Plugin users should monitor the WordPress plugin repository and the vendor's official channels for a security update addressing this broken access control vulnerability. Review the Patchstack Vulnerability Report for the latest remediation guidance.

Workarounds

• Implement additional access control layers using a security plugin with capability restrictions
• Configure your web application firewall to restrict access to Creator LMS AJAX and REST API endpoints to authenticated administrators only
• Limit user registration capabilities and review existing user roles for unnecessary permissions
• Consider network-level access controls to restrict WordPress admin functionality to trusted IP addresses

# Example .htaccess restriction for Creator LMS AJAX endpoints
# Add to WordPress root .htaccess to restrict access (adjust as needed)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^.*admin-ajax\.php.*$ [NC]
    RewriteCond %{QUERY_STRING} action=creatorlms [NC]
    RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC]
    RewriteRule .* - [F,L]
</IfModule>