CyberRota Analysis
AI-GeneratedThe LearnDash LMS plugin for WordPress is vulnerable to unrestricted file type uploads, allowing authenticated users with subscriber-level access or higher to upload arbitrary files, including potentially malicious PHP scripts, to the server. This vulnerability arises from inadequate input validation in the file upload process, posing a significant risk of remote code execution if server configurations permit it. WordPress site administrators using LearnDash should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndash_fileupload_process' function, which iterates through an entire array and validates only the first file. This makes it possible for authenticated attackers, with subscriber-level access and above who are enrolled in a course with assignment uploads enabled, to upload arbitrary disallowed files, including PHP files, to the server's wp-content/uploads/learndash/assignments/ directory. The uploaded files can only be used for Remote Code Execution if default server configurations have been changed to allow for execution.