CVE-2026-5060
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The MasterStudy LMS plugin for WordPress is vulnerable to Insecure Direct Object Reference in the stm_lms_delete_cover() function. Lack of ownership validation on the file_id parameter before calling wp_delete_attachment() allows authenticated users (Instructor and above) to delete arbitrary attachments of other users by enumerating IDs. Affects versions up to 3.7.14.
Risk Assessment
An attacker can delete arbitrary attachments, including files of other users, potentially leading to data loss or site disruption.
Recommendation
Update the MasterStudy LMS plugin to the latest version.
Other vulnerabilities in MasterStudy LMS
See all- CVE-2026-57330Medium
A Cross Site Scripting (XSS) vulnerability in MasterStudy LMS plugin version 3.7.27 and earlier allows an attacker with subscriber role to inject malicious script. This can lead to session theft or redirection to a malicious site.
- CVE-2026-42730High
The MasterStudy LMS has a Blind SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions from n/a through 3.7.29.
- CVE-2026-81342Low risk· EPSS 3%
The MasterStudy LMS WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs.
- CVE-2026-81200Low risk· EPSS 3%
The MasterStudy LMS WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order IDs.
- CVE-2026-81026Low risk· EPSS 4%
The MasterStudy LMS WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.
- CVE-2026-78284High
Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.
- CVE-2026-73404Medium
The MasterStudy LMS plugin version 3.7.41 and earlier has a broken access control vulnerability exploitable by Subscriber users. This means a subscriber can gain unauthorized access to functions they should not have permissions for.
- CVE-2026-68568Medium
Privilege Escalation vulnerability in MasterStudy LMS versions up to 3.7.41. The attack requires subscriber-level privileges.
- CVE-2026-28145Medium
The MasterStudy LMS plugin for WordPress (versions up to and including 3.7.39) has an insufficient verification of data authenticity vulnerability. It allows manipulating user state.
- CVE-2026-40766High
There is a SQL Injection vulnerability in the subscriber module in MasterStudy LMS versions up to 3.7.25.
Original NVD description (English source)
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the `stm_lms_delete_cover()` function lacking ownership validation on the `file_id` parameter before passing it to `wp_delete_attachment()`. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary attachments belonging to any user by enumerating sequential attachment IDs.