Executive brief
LearnDash is a popular WordPress plugin that enables organizations to create and manage online courses with assignment capabilities. The plugin contains a flaw in its file upload validation that allows authenticated course participants to upload files with dangerous types (such as PHP scripts) that should be blocked, potentially leading to unauthorized code execution on the server if server configurations permit it.
Technical details
The vulnerability is an unrestricted file type upload flaw in the 'learndash_fileupload_process' function within LearnDash versions up to 5.1.5. The root cause is insufficient input validation: the function iterates through an array of uploaded files but only validates the first file, allowing subsequent files to bypass type restrictions. Authenticated attackers with subscriber-level or higher privileges who are enrolled in a course with assignment uploads enabled can exploit this to upload arbitrary files (including PHP) to the wp-content/uploads/learndash/assignments/ directory. Remote code execution is possible only if the server is configured to execute scripts in that directory (non-default). A patch addressing this validation bypass is expected to be available.
Affected products
- LearnDash LearnDash LMS up to and including 5.1.5
Timeline
- 2026-09-04: disclosed
- other: CVE-2026-12483 assigned