CVE-2026-80067
MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata.
| CWE | CWE-22 |
| Vendor | stylemix |
| Product | masterstudy lms wordpress plugin |
| Published | Oct 29, 2026 |
| Last Updated | Oct 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for stylemix masterstudy lms wordpress plugin
Be the first to know when new medium vulnerabilities affecting stylemix masterstudy lms wordpress plugin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Stylemix / MasterStudy LMS WordPress Plugin
0 < 3.7.50
References
docs.stylemixthemes.com: https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-version wordpress.org: https://wordpress.org/plugins/masterstudy-lms-learning-management-system vulncheck.com: https://www.vulncheck.com/advisories/masterstudy-lms-wordpress-plugin-path-traversal-via-stm-lms-step-parameter
Credits
Jon Bytyqi