CVE-2026-12483

HighCVSS 7.5

Published: 04/09/2026(UTC)Updated: 08/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

31th percentile - higher than 31% of all known CVEs

Summary

The LearnDash LMS plugin for WordPress up to version 5.1.5 contains an unrestricted file type upload vulnerability. The 'learndash_fileupload_process' function validates only the first file in an array, allowing authenticated attackers with subscriber-level access to upload arbitrary disallowed files, including PHP files, to the wp-content/uploads/learndash/assignments/ directory.

Risk Assessment

An attacker can upload malicious files, which may lead to remote code execution if server configuration allows it, and potentially take over the website.

Recommendation

It is recommended to immediately update the LearnDash LMS plugin to a patched version and restrict file upload permissions to trusted users only.

Other vulnerabilities in LearnDash LMS

CVE-2026-12843Medium
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses without payment verification, bypassing the entire payment system and gaining unauthorized access to premium educational content.

Original NVD description (English source)

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndash_fileupload_process' function, which iterates through an entire array and validates only the first file. This makes it possible for authenticated attackers, with subscriber-level access and above who are enrolled in a course with assignment uploads enabled, to upload arbitrary disallowed files, including PHP files, to the server's wp-content/uploads/learndash/assignments/ directory. The uploaded files can only be used for Remote Code Execution if default server configurations have been changed to allow for execution.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS