Description
The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_init() function, which could allow unauthenticated users to upload arbitrary files to the web server
References (2)
Core 2
Core References
Exploit, Mailing List, Third Party Advisory x_refsource_misc
https://lists.openwall.net/full-disclosure/2018/01/10/17
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/9444f67b-8e3d-4cf0-b319-ed25e7db383a
Scores
CVSS v3
7.5
EPSS
0.0025
EPSS Percentile
47.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-862
CWE-434
Status
published
Products (1)
learndash/learndash
< 2.5.4
Published
Nov 01, 2021
Tracked Since
Feb 18, 2026