The vulnerability resides in the "learndash_fileupload_process" routine and allows an authenticated user with Subscriber-level access to upload files that bypass the intended whitelist. The flaw permits the upload of any file type, including PHP scripts, into the wp-content/uploads/learndash/assignments directory. Although the ability to execute code from this location depends on the server’s PHP configuration, the presence of executable files in a public directory presents a significant risk for remote code execution if default protections are altered.

StellarWP’s LearnDash LMS plugin for WordPress is affected. All releases up to and including version 5.1.5 contain the flaw. Administrators should verify whether their site uses a vulnerable version of the plugin and assess the assignment upload settings for courses to which subscribers are enrolled.

The CVSS score of 7.5 places the issue in the high severity tier, and it is not listed as a known exploited vulnerability by CISA. Exploitation requires an authenticated session with at least subscriber privileges and the existence of enabled assignment uploads. The attacker must also rely on the server allowing execution of PHP in the uploads directory; many standard WordPress configurations block such execution. Consequently, while the probability of exploitation without an active exploit code is reduced, the potential impact remains severe and should be treated as a high-risk threat.