CVE-2026-39598: WordPress Academy LMS Pro plugin < 3.5.2 - Arbitrary File Upload vulnerability

Synopsis

An arbitrary file upload vulnerability in the Academy LMS Pro WordPress plugin (versions before 3.5.2) allows a remote attacker to upload a web shell to the server. Exploitation requires a network connection and a high-privilege account, but no victim interaction, and the scope extends beyond the WordPress application itself. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected server. A patched-image rebuild at version 3.5.2 is available on HarborGuard for environments running an affected version of this plugin.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress application over the network; the plugin's upload endpoint is exposed via standard HTTP, making this exploitable remotely.

• AuthenticationRequired

  A high-privilege WordPress account (such as an administrator) is required, meaning the attacker must already control or compromise such an account before uploading a web shell.

• Victim interactionNot required

  No victim interaction is needed; the attacker can upload the malicious file entirely through their own authenticated requests without involving any other user.

• Attack complexityDetail

  Attack complexity is rated High, meaning exploitation depends on environmental factors or specific conditions beyond the attacker's full control, such as particular server configurations or upload permission states.

Blast Radius

• Reads any file accessible to the web server process, including WordPress configuration files containing database credentials and secret keys.
• Modifies or deletes arbitrary files on the server, including WordPress core files, plugin code, and theme assets.
• Executes arbitrary operating system commands through the uploaded web shell, giving the attacker a persistent foothold on the host.
• Disrupts availability of the web server and any co-located services by terminating processes, consuming resources, or corrupting critical files.