Unrestricted File Type Upload Vulnerability in LearnDash LMS Plugin

Executive Summary

The LearnDash LMS plugin for WordPress has a vulnerability that allows authenticated attackers to upload arbitrary files, including PHP files, to the server. This vulnerability affects versions up to and including 5.1.5 and has a CVSS score of 7.5.

Technical Analysis

The vulnerability is caused by insufficient input validation in the 'learndash_fileupload_process' function, which only validates the first file in an array of uploaded files. This allows attackers to upload arbitrary files, including PHP files, to the server's wp-content/uploads/learndash/assignments/ directory.

How It Gets Exploited

An authenticated attacker with subscriber-level access and above who is enrolled in a course with assignment uploads enabled can exploit this vulnerability. The attacker would send a crafted request to the server with a malicious file, such as a PHP file, in the upload. The server would then upload the file to the wp-content/uploads/learndash/assignments/ directory without proper validation. If the server's configuration allows for PHP execution, the attacker could potentially achieve Remote Code Execution.

Impact Assessment

The vulnerability affects LearnDash LMS plugin versions up to and including 5.1.5. The CVSS score for this vulnerability is 7.5, indicating a high severity level. If exploited, an attacker could potentially achieve Remote Code Execution, leading to a high impact on confidentiality, integrity, and availability.

Recommended Actions

To mitigate this vulnerability, update the LearnDash LMS plugin to version 5.1.6 or later. Additionally, server administrators should ensure that the server's configuration does not allow for PHP execution in the wp-content/uploads/learndash/assignments/ directory.

Sources

- National Vulnerability Database (NVD) - Wordfence