CVE-2026-39598: WordPress Academy LMS Pro plugin < 3.5.2 - Arbitrary File Upload vulnerability
Published Jun 16, 2026
·Updated
Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server.
This issue affects Academy LMS Pro: from n/a before 3.5.2.
Affected Software
1 affected component
Kodezen LLC Academy LMS Pro<3.5.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Academy LMS Pro (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.5.2
Event History
Jun 16, 2026
CVE Published
via MITRE·09:24 PM
Data Sourced
via MITRE·09:24 PM
RemedyDescriptionSeverityWeakness
Jun 17, 2026
Data Sourced
via NVD·01:20 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-39598?
CVE-2026-39598 has a severity rating of high with a score of 8.
2
How do I fix CVE-2026-39598?
To fix CVE-2026-39598, update the Academy LMS Pro plugin to version 3.5.2 or later.
3
What type of vulnerability is CVE-2026-39598?
CVE-2026-39598 is classified as an Arbitrary File Upload vulnerability.
4
What impact does CVE-2026-39598 have on WordPress sites?
CVE-2026-39598 allows attackers to upload web shells, potentially compromising the web server.
5
Which versions of Academy LMS Pro are affected by CVE-2026-39598?
CVE-2026-39598 affects versions of Academy LMS Pro before 3.5.2.