High · 8.0 CVE-2026-39598 EUVD-2026-37502GHSA-pf64-5xcw-6787

WordPress Academy LMS Pro plugin < 3.5.2 - Arbitrary File Upload vulnerability

Published Jun 16, 2026 · Updated Jun 17, 2026 · Assigned by Patchstack

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server.

This issue affects Academy LMS Pro: from n/a before 3.5.2.

Vendor	Product	Affected	Fixed
Kodezen	Academy LMS Pro	< 3.5.2	3.5.2