Creator LMS – Online Courses and eLearning Plugin Security & Risk Analysis

The creatorlms v1.2.2 plugin exhibits a mixed security posture. While it demonstrates good practices such as a high percentage of prepared SQL statements and numerous nonce and capability checks, several significant concerns are present. The static analysis reveals a substantial attack surface with 12 entry points, two of which lack proper permission callbacks in the REST API. Furthermore, the presence of the `unserialize` function, a known vector for deserialization vulnerabilities, is a notable risk. Taint analysis highlights 5 high-severity flows with unsanitized paths, indicating potential for malicious data injection. The vulnerability history, while showing no currently unpatched CVEs, reveals past issues, including a high-severity vulnerability, primarily related to missing authorization. The plugin's last known vulnerability was in 2026, suggesting potential for recurring issues. Overall, while some security fundamentals are implemented well, the identified attack surface, taint flows, and past vulnerability patterns warrant careful consideration and mitigation.