CVE-2018-25019

PoC ×2—

CVSS 3.1

7.5 high

EPSS

2%p74

Published

Nov 1, 2021 (Nov 1, 2021)

Modified

Jun 17, 2026

Description

The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_init() function, which could allow unauthenticated users to upload arbitrary files to the web server

Vendors: learndash
Products: learndash
Ecosystems: WordPress
Weakness: CWE-434, CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.6%)

In the news0 stories

No ingested article mentions this CVE yet.