{"id":"CVE-2026-62129","published":"2026-10-10T20:16:44.780","lastModified":"2026-10-13T13:28:15.717","description":"Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/creatorlms/vulnerability/wordpress-creator-lms-plugin-1-2-21-arbitrary-file-upload-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"CVE-2026-62129 is a critical vulnerability in Creator LMS that allows authenticated users to upload arbitrary files, potentially leading to remote code execution. This flaw is particularly dangerous because it affects the contributor role, which may be granted to users who should only have limited content creation capabilities.","exploitability":"Exploitation requires an authenticated user account with contributor privileges, making it moderately difficult to achieve but not highly complex, as most LMS platforms allow contributor accounts to be created by administrators or through self-registration.","blast_radius":"If exploited, this vulnerability could allow attackers to upload malicious files that execute arbitrary code on the server, potentially compromising the entire learning management system and all user data it contains.","remediation":"Upgrade to Creator LMS version 1.2.22 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["lms","file-upload","arbitrary-file-upload"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:42:57.077Z"}}