Description

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndash_fileupload_process' function, which iterates through an entire array and validates only the first file. This makes it possible for authenticated attackers, with subscriber-level access and above who are enrolled in a course with assignment uploads enabled, to upload arbitrary disallowed files, including PHP files, to the server's wp-content/uploads/learndash/assignments/ directory. The uploaded files can only be used for Remote Code Execution if default server configurations have been changed to allow for execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T14:17:17.480Z",
  "pubdate": "2026-09-04T14:17:17.480Z",
  "executiveSummary": "The LearnDash LMS plugin for WordPress, in versions up to and including 5.1.5, contains an Unrestricted File Type Upload vulnerability.\nThe issue originates from flawed input validation logic within the 'learndash_fileupload_process' function.\nThis vulnerability allows authenticated users with subscriber-level privileges or higher, specifically those enrolled in a course with assignment uploads enabled, to bypass security controls.\nAttackers can successfully upload arbitrary, disallowed file types, such as malicious PHP scripts, into the 'wp-content/uploads/learndash/assignments/' directory.\nWhile the primary impact is the unauthorized storage of potentially malicious files, successful Remote Code Execution (RCE) is contingent upon the underlying server configuration permitting the execution of scripts within the uploads directory.\nThis flaw presents a significant security risk, as it permits the persistence of malicious code on the web server, which could be leveraged to gain further control over the host environment if directory execution restrictions are absent.",
  "technicalDetails": "The vulnerability resides within the 'learndash_fileupload_process' function of the LearnDash LMS plugin, which is responsible for handling file uploads for course assignments.\nThe root cause of this flaw is an incomplete input validation routine during the processing of uploaded file arrays. Specifically, the function iterates through the uploaded files array but performs security validation, such as checking file extensions and MIME types, only on the initial element of that array.\nBy submitting a specially crafted multipart/form-data request, an attacker can bypass the validation logic for subsequent files in the array. This allows the upload of arbitrary file formats, including executable PHP scripts, to the designated 'wp-content/uploads/learndash/assignments/' directory.\nExploitation requires the attacker to be an authenticated WordPress user with at least subscriber-level access and enrollment in a course where the instructor has enabled assignment uploads. Once these prerequisites are met, the attacker can intercept the submission request and append prohibited file extensions to the payload.\nUpon successful transmission, the server saves the malicious file to the filesystem. If the server's environment is misconfigured—for example, if the 'wp-content/uploads/' directory is not restricted from executing server-side scripts—the attacker may execute the uploaded PHP file by requesting it directly through its web-accessible path.\nThis behavior facilitates arbitrary code execution, which can lead to full site compromise, sensitive data exfiltration, or unauthorized modification of the WordPress database and core files. The post-exploitation potential is strictly dependent on the server's ability to interpret and execute scripts from within the uploads storage path."
}