CVE-2024-56054 CRITICAL

CVE-2024-56054: WordPress WPLMS plugin < 1.9.9.5.2 - Instructor+ Arbitrary File Upload vulnerability

Vendor Vibethemes
Product WPLMS
Weakness CWE-434 · Unrestricted file upload
Published December 18, 2024
Last update May 12, 2026
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

Explanation of Vulnerability in Simple Terms

02Summary

WPLMS versions up to 1.9.9.5.2 allow authenticated administrators to upload files without proper validation. An attacker with admin privileges can upload malicious files that execute on the site, potentially compromising the entire installation. The vulnerability affects confidentiality, integrity, and availability of the site.

What an attacker can do

03Attacker Capabilities

Upload and execute malicious files on the site with admin-level access.

Potential impact on your site

04Site Impact

An admin account compromise allows file upload attacks that can take over your entire site.

Conditions required to exploit

05Prerequisites

Attacker must have administrator privileges on the WordPress site.

Key dates

06Disclosure timeline

December 18, 2024 CVE published
May 12, 2026 Record updated