This vulnerability in WPFunnels Creator LMS (up to version 1.1.18) arises from incorrect privilege assignment, enabling an attacker with some privileges to escalate their privileges further. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no user interaction, and it results in high impact on confidentiality, integrity, and availability of the affected system. No official patch or fix details are available at this time, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation allows an attacker with limited privileges to escalate their privileges, potentially gaining full control over the affected LMS system. This can lead to unauthorized access to sensitive data, modification or deletion of content, and disruption of service availability. The high CVSS score reflects the serious impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to the affected versions of Creator LMS to trusted users only and monitor for suspicious activity related to privilege escalation attempts. Avoid exposing the affected system to untrusted networks where possible.