CVE-2026-80067
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
The MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata.
Risk Assessment
An attacker could publish arbitrary content under their identity, potentially leading to misinformation, malicious content distribution, or site integrity compromise.
Recommendation
Update MasterStudy LMS to version 3.7.50 or later and restrict Subscriber capabilities and access to import actions.
Other vulnerabilities in MasterStudy LMS
See all- CVE-2026-118090High
The WordPress plugin MasterStudy LMS in versions up to 3.7.55 contains a PHP Object Injection vulnerability exploitable by a subscriber-level user. This may lead to injection of a malicious PHP object.
- CVE-2026-80069Medium
The MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via cross-site request forgery to cause an uncaught PHP fatal error that, when display_errors is enabled, discloses the plugin's absolute filesystem path.
- CVE-2026-118092Medium
The MasterStudy LMS WordPress plugin (up to version 3.7.55) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions reserved for privileged roles.
- CVE-2026-105079Medium
Stored XSS vulnerability in MasterStudy LMS (up to 3.7.52) due to improper input neutralization.
- CVE-2026-88847Medium
The MasterStudy LMS WordPress Plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to.
- CVE-2026-81339Medium
The MasterStudy LMS WordPress plugin before version 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal (subscriber) role to read other students' quiz grades, pass/fail status and attempt timestamps by referencing an attempt identifier belonging to another user.
- CVE-2026-81338Medium
The MasterStudy LMS WordPress plugin before version 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.
- CVE-2026-88844Low
The MasterStudy LMS WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.
- CVE-2026-81199Medium
The MasterStudy LMS WordPress Plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user.
- CVE-2026-81198Low
The MasterStudy LMS WordPress Plugin before version 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other instructors.
Original NVD description (English source)
MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS