Unrestricted File Upload Vulnerability in Kodezen Academy LMS Pro
CVE-2026-39598

8HIGH

Key Information:

Vendor

WordPress
Status
Academy Lms Pro
Vendor
CVE Published:
16 June 2026

What is CVE-2026-39598?

The Kodezen LLC Academy LMS Pro has a vulnerability that permits unrestricted file uploads, enabling attackers to upload malicious files such as web shells to the server. This flaw compromises the security of the web application, posing a significant risk to user data and overall system integrity. Organizations using versions prior to 3.5.2 are advised to update their software to mitigate this vulnerability.

Affected Version(s)

Academy LMS Pro < 3.5.2

References

https://patchstack.com/database/wordpress/plugin/academy-...
vdb-entry

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

luc | Patchstack
.