CVE-2026-12483: 
WordPress vulnerability analysis and mitigation

CVE-2026-12483 is an Unrestricted File Type Upload vulnerability in the LearnDash LMS plugin for WordPress, affecting versions up to and including 5.1.5, developed by StellarWP. The flaw resides in the learndash_fileupload_process function, which only validates the first file in an uploaded array, allowing subsequent files to bypass type restrictions. It was published on September 4, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerable learndash_fileupload_process function iterates through an array of uploaded files but applies file type validation only to the first element, leaving all subsequent files unchecked. An authenticated attacker — at minimum a subscriber-level user enrolled in a course with assignment uploads enabled — can exploit this by submitting a multi-file upload request where the first file passes validation and subsequent files (e.g., PHP webshells) are written to wp-content/uploads/learndash/assignments/. Remote Code Execution (RCE) is only achievable if the server has been non-default configured to permit script execution within that upload directory (GitHub Advisory, Wordfence).

Successful exploitation allows an authenticated attacker to write arbitrary PHP files to the server's wp-content/uploads/learndash/assignments/ directory. If the server is configured to execute scripts in that directory (a non-default configuration), this can escalate to full Remote Code Execution, resulting in high confidentiality, integrity, and availability impact — including potential data exfiltration, site defacement, and lateral movement within the hosting environment. Even without RCE, the ability to upload arbitrary file types may facilitate other attacks such as stored malware delivery (GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment confirms exploitation is currently "none" and the attack is not automatable, as it requires authenticated access and enrollment in a course with assignment uploads enabled. The EPSS score is approximately 0.382%, placing it in the 32nd percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites running LearnDash LMS plugin version ≤ 5.1.5 using tools like WPScan or by checking the plugin version in publicly accessible readme files.
2. Account Registration: Register or obtain a subscriber-level (or higher) account on the target WordPress site.
3. Course Enrollment: Enroll in a course that has assignment uploads enabled, which is required to access the upload functionality.
4. Craft Malicious Upload Request: Prepare a multi-file upload request where the first file is a legitimate, allowed file type (e.g., a .pdf or .jpg) to pass the validation check, and include a PHP webshell (e.g., shell.php) as a subsequent file in the same upload array.
5. Submit Upload: Submit the crafted request to the assignment upload endpoint. The learndash_fileupload_process function validates only the first file, allowing the PHP file to be written to wp-content/uploads/learndash/assignments/.
6. Trigger RCE (if applicable): If the server is configured to execute PHP in the uploads directory (non-default), access the uploaded PHP file via its URL (e.g., https://target.com/wp-content/uploads/learndash/assignments/shell.php) to achieve Remote Code Execution (GitHub Advisory, Wordfence).

• File System: Presence of .php files (or other executable script types) in wp-content/uploads/learndash/assignments/; unexpected files with names inconsistent with legitimate assignment submissions.
• Logs: Web server access logs showing POST requests to the LearnDash assignment upload endpoint followed by GET requests to .php files within wp-content/uploads/learndash/assignments/; PHP error logs showing execution attempts from the assignments directory.
• Network: Outbound connections from the web server process to unknown external IPs, potentially indicating a reverse shell or data exfiltration following successful RCE.
• Process: Unusual child processes spawned by the web server (e.g., php, /bin/bash, curl, wget) originating from the assignments upload directory.

Update the LearnDash LMS plugin to a version beyond 5.1.5 that includes proper file type validation for all files in upload arrays — a patch was made available on September 4, 2026 (GitHub Advisory). As an immediate workaround, add web server rules (e.g., an .htaccess file for Apache, or equivalent Nginx configuration) to block PHP execution within the wp-content/uploads/learndash/assignments/ directory. If assignment upload functionality is not actively used, disable it in the LearnDash course settings to eliminate the attack surface entirely (Wordfence).