LearnDash LMS EUVD-2026-71098

Three prerequisites must all be met: (1) the attacker must hold at least a WordPress subscriber-level account (PR:L - unauthenticated exploitation is not possible); (2) that account must be enrolled in a specific course that has the assignment uploads feature enabled by an instructor or admin - courses with uploads disabled are not reachable through this path; (3) for actual remote code execution, the web server must be configured to allow PHP script execution within wp-content/uploads/learndash/assignments/, which is non-default and contrary to standard WordPress hardening. Sites with default Apache .htaccess rules or managed hosting PHP restrictions in the uploads directory can receive the malicious file upload but cannot have it executed, limiting impact to unauthorized file storage. The multi-file array bypass technique requires the attacker to craft a custom HTTP request rather than use a standard browser upload form.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.5) accurately represents the worst-case RCE scenario but bundles two distinct risk tiers: the file upload itself (AC:L once prerequisites are met) and RCE (AC:H requiring server misconfiguration). In practice, most WordPress deployments on managed or hardened hosts will not allow PHP execution in the uploads directory, reducing the realistic impact to unauthorized file storage rather than RCE. The attack surface is further constrained by three prerequisite conditions - authenticated access, course enrollment, and assignment uploads being enabled - making fully automated, opportunistic exploitation unlikely. No EPSS data was provided; no KEV listing exists; no POC has been identified. Real-world priority is moderate: WordPress LMS sites that permit public registration and have courses with assignment uploads enabled face meaningful risk if their upload directory lacks execution restrictions, but default WordPress hardening substantially limits exposure.

An attacker registers a free subscriber account on a WordPress site running LearnDash ≤5.1.5, enrolls in any course that has assignment uploads enabled, and crafts a multipart/form-data POST request to the assignment upload endpoint containing an array of files where the first element is a legitimate image or document and the second is a PHP webshell. Because learndash_fileupload_process validates only the first array entry, the PHP file is written to wp-content/uploads/learndash/assignments/. If the web server is misconfigured to execute PHP in the uploads directory, the attacker GETs the uploaded PHP path to trigger arbitrary command execution.