CVE-2026-39598: Academy LMS Pro RCE Vulnerability

CVE-2026-39598 Overview

CVE-2026-39598 is an unrestricted file upload vulnerability in the Kodezen LLC Academy LMS Pro WordPress plugin. The flaw allows authenticated attackers to upload files of dangerous types, including web shells, to the web server. The vulnerability affects all versions of Academy LMS Pro prior to 3.5.2 and is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Successful exploitation grants attackers persistent code execution within the WordPress environment. The issue is tracked through Patchstack's WordPress Vulnerability Database.

Critical Impact
Attackers with high-privilege access can upload web shells to gain arbitrary code execution on the underlying web server, compromising the entire WordPress instance.

Affected Products

Kodezen LLC Academy LMS Pro WordPress plugin (all versions before 3.5.2)
WordPress sites running the academy-pro plugin
Learning management system deployments using Academy LMS Pro

Discovery Timeline

2026-06-17 - CVE-2026-39598 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-39598

Vulnerability Analysis

The vulnerability resides in the file upload handling logic of Academy LMS Pro versions prior to 3.5.2. The plugin fails to enforce restrictions on the types of files that authenticated users can upload through its upload endpoints. This allows attackers to bypass file type validation and write executable PHP files to web-accessible directories.

The attack requires high privileges (PR:H) but no user interaction, and it can be conducted over the network. The scope is changed (S:C), meaning a successful attack can affect resources beyond the vulnerable component, with full impact to confidentiality, integrity, and availability. The EPSS score of 0.283% places this issue in the 19.9th percentile for predicted exploitation activity.

Root Cause

The root cause is missing or inadequate validation of file extensions, MIME types, and file content during the upload process. The plugin accepts files without verifying whether they contain server-executable code, allowing PHP scripts or other dangerous payloads to be persisted within the web root. This is a textbook [CWE-434] failure pattern.

Attack Vector

An authenticated attacker with elevated privileges submits a crafted HTTP request to an Academy LMS Pro upload handler. The request includes a file with a dangerous extension such as .php or a polyglot payload that evades any partial type checks. Once the file lands in a web-accessible path, the attacker requests it directly to trigger execution.

No public exploit code or proof-of-concept has been released for CVE-2026-39598 at this time. Refer to the Patchstack advisory for additional technical context.

Detection Methods for CVE-2026-39598

Indicators of Compromise

New or unexpected .php, .phtml, or .phar files inside Academy LMS Pro upload directories under wp-content/uploads/
Outbound network connections originating from the WordPress PHP process to unfamiliar hosts following an upload event
Recently modified files in plugin or media directories with shell-like content such as eval(, base64_decode(, or system(
Unusual administrator or instructor account activity preceding file uploads

Detection Strategies

Monitor web server access logs for POST requests to Academy LMS Pro upload endpoints followed by GET requests to newly created files in upload paths
Deploy file integrity monitoring on wp-content/uploads/ and plugin directories to alert on creation of executable file types
Inspect WordPress audit logs for file upload activity by accounts that should not normally upload media

Monitoring Recommendations

Enable web application firewall rules that block uploads of executable file extensions to WordPress endpoints
Forward web server, PHP-FPM, and WordPress logs to a centralized SIEM for correlation of upload and execution patterns
Alert on PHP process spawning shell binaries such as /bin/sh, bash, nc, or curl

How to Mitigate CVE-2026-39598

Immediate Actions Required

Upgrade Academy LMS Pro to version 3.5.2 or later on all affected WordPress sites
Audit existing files in wp-content/uploads/ and plugin directories for unauthorized scripts and remove any web shells found
Rotate credentials for all high-privilege WordPress accounts that could have been abused to reach the vulnerable upload handler
Review WordPress user roles and remove unnecessary elevated privileges

Patch Information

Kodezen LLC has addressed the vulnerability in Academy LMS Pro version 3.5.2. Administrators should update through the plugin management interface or download the patched release. Detailed remediation guidance is available in the Patchstack vulnerability report.

Workarounds

Restrict access to WordPress admin and instructor accounts using network ACLs or IP allowlists until the patch is applied
Configure the web server to deny PHP execution within wp-content/uploads/ using directives such as php_flag engine off in an .htaccess file or equivalent Nginx location blocks
Deploy a WordPress security plugin or web application firewall that blocks uploads of dangerous file types
Temporarily disable the Academy LMS Pro plugin if patching cannot be completed promptly

bash

# Apache: deny PHP execution in WordPress uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
    return 403;
}