CVE-2018-25019

CVE-2018-25019: LearnDash < 2.5.4 - Unauthenticated Arbitrary File Upload

Vendor Unknown

Product LearnDash LMS

Weakness CWE-434 · Unrestricted file upload

Published November 1, 2021

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_init() function, which could allow unauthenticated users to upload arbitrary files to the web server

Key dates

02Disclosure timeline

November 1, 2021 CVE published

August 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-25019 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2023-6576 Byzoro S210 HTTP POST Request uploadfile.php unrestricted upload CVE-2024-8940 Unrestricted Upload of File with Dangerous Type vulnerability on Scriptcase CVE-2023-28128 CVE-2026-6692 Slider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url CVE-2020-36897 QiHang Media Web Digital Signage 3.0.9 Unauthenticated Remote Code Execution