CVE-2026-12843

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses...

CVE-2026-12843 LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses...

CVE-2026-12843 LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses...

CVE-2026-12843

The LearnDash LMS WordPress plugin is affected by an authorization bypass in versions 4.25.0 through 5.1.6 , caused by improper verification of user authorization via a REST endpoint. Unauthenticated attackers can enroll arbitrary users in paid courses without payment verification, effectively by...

EUVD-2026-71990

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses...

WordPress LearnDash LMS plugin 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint vulnerability

WordPress LearnDash LMS plugin 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint vulnerability discovered by Applied Cybernetics in WordPress Plugin LearnDash LMS versions 4.25.0-5.1.6...

PT-2026-86407

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses...

CVE-2026-12843: Missing Authorization

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses...

CVE-2026-12483

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...

CVE-2026-12483 LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...

EUVD-2026-71098

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...

CVE-2026-12483 LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...

CVE-2026-12483

The LearnDash LMS plugin for WordPress (versions ≤ 5.1.5 ) is vulnerable to an Unrestricted File Type Upload caused by insufficient input validation in the learndash_fileupload_process function, which validates only the first file in a multi-file array. Authenticated users with subscriber-level a...

WordPress LearnDash LMS plugin <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Nguyen Ngoc Duc duc193 in WordPress Plugin LearnDash LMS versions = 5.1.5...

PT-2026-85525

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndash fileupload process' function, which iterates through an entire array and validates only the first file. This...

CVE-2026-12483: Unrestricted Upload of File with Dangerous Type

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...

CVE-2026-3079

The LearnDash LMS plugin for WordPress is vulnerable to blind time-based SQL Injection via the 'filtersorderbyorder' parameter in the 'learndashpropaneltemplate' AJAX action in all versions up to, and including, 5.0.3. This is due to insufficient escaping on the user supplied parameter and lack o...

CVE-2026-3079 LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter

The LearnDash LMS plugin for WordPress is vulnerable to blind time-based SQL Injection via the 'filtersorderbyorder' parameter in the 'learndashpropaneltemplate' AJAX action in all versions up to, and including, 5.0.3. This is due to insufficient escaping on the user supplied parameter and lack o...

CVE-2026-3079 LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter

The LearnDash LMS plugin for WordPress is vulnerable to blind time-based SQL Injection via the 'filtersorderbyorder' parameter in the 'learndashpropaneltemplate' AJAX action in all versions up to, and including, 5.0.3. This is due to insufficient escaping on the user supplied parameter and lack o...

CVE-2026-3079

CVE-2026-3079 affects the LearnDash LMS WordPress plugin. The vulnerability is a blind time-based SQL injection in the AJAX action learndash_propanel_template caused by insufficient escaping of the parameter filters[orderby_order] . It impacts all versions up to and including 5.0.3. Exploitation ...