CVE-2024-4397: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file t

LearnPress, a WordPress plugin for learning management systems, has a vulnerability (CVE-2024-4397) in versions up to 4.2.6.5 where the 'save_post_materials' function doesn't properly check file types before uploading. This means instructors and higher-level users could upload malicious files to the server, potentially leading to RCE (remote code execution, where attackers run arbitrary commands on a system they don't own).