CVE-2026-12483: CWE-434 Unrestricted Upload of File with Dangerous Type in StellarWP LearnDash LMS

CVE-2026-12483 describes an unrestricted file upload vulnerability in the LearnDash LMS WordPress plugin up to version 5.1.5. The vulnerability is due to improper input validation in the 'learndash_fileupload_process' function, which validates only the first file in a batch, allowing authenticated users with subscriber-level privileges enrolled in certain courses to upload arbitrary file types, including potentially dangerous PHP files. These files are stored in the wp-content/uploads/learndash/assignments/ directory. Exploitation for remote code execution depends on server configuration allowing execution of uploaded files in this directory.

An attacker with subscriber-level access enrolled in a course with assignment uploads enabled can upload arbitrary files, including PHP scripts, to the server. This can lead to full compromise of confidentiality, integrity, and availability if the server is configured to execute uploaded PHP files in the specified directory. The CVSS 3.1 base score of 7.5 reflects high impact with network attack vector, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and review server configurations to prevent execution of uploaded files in the wp-content/uploads/learndash/assignments/ directory. Consider disabling assignment uploads or limiting course enrollment to trusted users as temporary mitigations.