CVE-2026-12483

LearnDash LMS for WordPress in versions up to and including 5.1.5 contains an unrestricted file type upload flaw in its assignment-upload feature: the learndash_fileupload_process function validates only the first file in a submission, allowing disallowed file types such as PHP to slip through. To exploit it, an attacker needs a subscriber-level or higher account enrolled in a course with assignment uploads enabled, then submits multiple files so that later, unvalidated ones are accepted into wp-content/uploads/learndash/assignments/. Uploaded PHP files can lead to remote code execution only if the server has been reconfigured to execute PHP from that directory, which is not the default; otherwise the impact is limited to arbitrary file upload. Any WordPress site running LearnDash 5.1.5 or earlier with the assignment upload feature enabled in an active course is affected. No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and EPSS estimates only a 0.4% probability of exploitation within the next 30 days.

What to do: Sites running LearnDash 5.1.5 or earlier should update to the latest patched release. As an interim mitigation, disable assignment uploads in courses and configure the web server to deny PHP execution within wp-content/uploads/learndash/assignments/. Administrators should also inspect that directory for unexpected PHP files that could indicate prior abuse.