CVE-2026-80069
MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via cross-site request forgery to cause an uncaught PHP fatal error that, when display_errors is enabled, discloses the absolute filesystem path of the plugin.
| CWE | CWE-22 |
| Vendor | stylemix |
| Product | masterstudy lms wordpress plugin |
| Published | Oct 29, 2026 |
| Last Updated | Oct 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for stylemix masterstudy lms wordpress plugin
Be the first to know when new medium vulnerabilities affecting stylemix masterstudy lms wordpress plugin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
Stylemix / MasterStudy LMS WordPress Plugin
0 < 3.7.50
References
docs.stylemixthemes.com: https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-version wordpress.org: https://wordpress.org/plugins/masterstudy-lms-learning-management-system vulncheck.com: https://www.vulncheck.com/advisories/masterstudy-lms-wordpress-plugin-missing-authorization-via-stm-lms-send-test-email-ajax
Credits
Jon Bytyqi