CVE-2026-12483: LearnDash LMS WordPress Plugin RCE Vulnerability

CVE-2026-12483 Overview

CVE-2026-12483 is an Unrestricted File Type Upload vulnerability in the LearnDash LMS plugin for WordPress, affecting all versions up to and including 5.1.5. The flaw resides in the learndash_fileupload_process function, which validates only the first file in an uploaded array while accepting the rest without checks. Authenticated users with subscriber-level access or higher, enrolled in a course that permits assignment uploads, can upload disallowed file types including PHP scripts to the wp-content/uploads/learndash/assignments/ directory. Remote code execution is possible only when server configurations have been modified to allow script execution in that path.

Critical Impact
Authenticated attackers can upload arbitrary file types, including PHP payloads, potentially leading to remote code execution on misconfigured servers.

Affected Products

LearnDash LMS plugin for WordPress, versions up to and including 5.1.5
WordPress sites with LearnDash assignment upload functionality enabled
Web servers configured to execute scripts within the uploads directory

Discovery Timeline

2026-09-04 - CVE-2026-12483 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-12483

Vulnerability Analysis

The vulnerability is classified as an Unrestricted Upload of File with Dangerous Type [CWE-434]. LearnDash's assignment upload workflow calls the learndash_fileupload_process function to validate submitted files. The function iterates through the submitted file array but performs type validation against only the first element. Any additional files in the same request bypass the allowlist check entirely.

Authenticated users with the subscriber role or above who are enrolled in a course with assignment uploads enabled can abuse this flaw. Attackers craft a multi-file upload where the first file is a legitimate document and subsequent files carry disallowed extensions such as .php. The server writes all files to wp-content/uploads/learndash/assignments/.

Exploitation results in remote code execution only when the WordPress host has been configured to permit PHP execution within the uploads path. Default WordPress and Apache/Nginx configurations that block script execution in wp-content/uploads/ prevent direct code execution but still allow arbitrary file storage.

Root Cause

The root cause is incomplete input validation in an iteration loop. The learndash_fileupload_process function short-circuits its allowlist check after the first array element, leaving trailing files unvalidated. The design assumption that upload requests contain a single file does not match actual PHP $_FILES handling for array-based uploads.

Attack Vector

Exploitation requires network access, an authenticated account with subscriber privileges, and enrollment in a course that accepts assignment uploads. The attacker submits a multi-file HTTP POST request to the assignment upload endpoint. The first file passes validation while attached PHP files are written to disk. If the target server allows script execution within the assignments directory, the attacker requests the uploaded file to trigger code execution.

See the Wordfence Vulnerability Report A539BA27 for additional technical details.

Detection Methods for CVE-2026-12483

Indicators of Compromise

Presence of files with executable extensions such as .php, .phtml, or .phar within wp-content/uploads/learndash/assignments/
Web server access logs showing GET or POST requests to script files under the LearnDash assignments upload path
Assignment submission records in the WordPress database referencing files that do not match the course's declared allowed extensions

Detection Strategies

Audit the wp-content/uploads/learndash/assignments/ directory recursively for any file whose extension is outside the assignment allowlist configured for each course
Review web server logs for multi-part upload requests to LearnDash endpoints containing more than one file input, correlated with subscriber-role sessions
Monitor for new PHP or executable file creation events in WordPress upload directories using file integrity monitoring

Monitoring Recommendations

Enable file integrity monitoring on the entire wp-content/uploads/ tree to alert on creation of executable file types
Log and alert on HTTP requests that both write to and later read from the LearnDash assignments directory
Track subscriber-level account creations followed by course enrollments and rapid assignment submissions as a behavioral pattern

How to Mitigate CVE-2026-12483

Immediate Actions Required

Update LearnDash LMS to a version later than 5.1.5 once a patched release is available from the vendor
Verify that the web server blocks execution of PHP and other server-side scripts within wp-content/uploads/ and all subdirectories
Audit existing files in wp-content/uploads/learndash/assignments/ and remove any files with disallowed extensions
Review subscriber-level and student accounts for unexpected registrations or enrollments in courses accepting assignment uploads

Patch Information

Refer to the Wordfence Vulnerability Report A539BA27 and the LearnDash product page for the fixed release version and vendor advisory. Apply the update to all WordPress installations running affected versions of the plugin.

Workarounds

Disable assignment uploads on all courses until the plugin is updated
Restrict user registration and require administrator approval for new accounts to limit the pool of authenticated attackers
Configure the web server to deny execution of .php, .phtml, .phar, and similar script extensions inside wp-content/uploads/
Deploy a web application firewall rule that blocks multi-file uploads to the LearnDash assignment endpoint

bash

# Apache: block script execution in the LearnDash uploads directory
# Place in .htaccess within wp-content/uploads/learndash/
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|pht|inc)$">
    Require all denied
</FilesMatch>

# Nginx equivalent (server block)
location ~* /wp-content/uploads/learndash/.*\.(php|phtml|phar|pht|inc)$ {
    deny all;
    return 403;
}