CVE-2025-4800 in MasterStudy LMS Pro Plugin
Summary
by MITRE • 05/28/2025
The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stm_lms_add_assignment_attachment function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/28/2025
The vulnerability identified as CVE-2025-4800 affects the MasterStudy LMS Pro plugin for WordPress, a widely used learning management system solution that enables educational institutions and organizations to create and manage online courses. This particular flaw resides within the stm_lms_add_assignment_attachment function, which handles file attachment processing for assignment submissions within the learning management environment. The issue represents a critical security gap that undermines the integrity of the platform's file handling mechanisms and creates significant risks for organizations relying on this plugin for their educational delivery systems.
The technical flaw stems from the absence of proper file type validation within the stm_lms_add_assignment_attachment function, which operates without adequate sanitization of uploaded file extensions or content checks. This missing validation allows authenticated users with Subscriber-level privileges and above to bypass normal file upload restrictions and upload files of any type to the server. The vulnerability specifically affects all versions of the plugin up to and including version 4.7.0, indicating that the security flaw existed for an extended period without proper mitigation. The lack of file type validation creates an environment where attackers can upload malicious files such as php, aspx, or other executable scripts that could be leveraged for further exploitation.
The operational impact of this vulnerability is severe and multifaceted, as it provides attackers with a pathway to achieve remote code execution on the affected WordPress server. Once an attacker successfully uploads a malicious file, they can potentially execute arbitrary code on the server, leading to complete system compromise, data exfiltration, or the establishment of persistent backdoors. The vulnerability affects not only individual user accounts but also the entire learning management system infrastructure, potentially exposing sensitive educational data, student information, and institutional resources. Organizations using this plugin may face significant compliance and regulatory issues if student data is compromised through this vector, particularly in environments subject to education-specific regulations such as FERPA or GDPR.
From a cybersecurity perspective, this vulnerability aligns with CWE-434, which addresses the insecure upload of files, and represents a clear violation of the principle of least privilege and input validation. The ATT&CK framework categorizes this as a file upload vulnerability that can be leveraged for initial access and privilege escalation, potentially enabling attackers to move laterally within the network. The fact that this vulnerability requires only Subscriber-level access demonstrates how easily attackers can gain a foothold in systems that rely on role-based access controls. Organizations should implement immediate mitigations including updating to the latest plugin version, implementing additional file validation mechanisms, and conducting comprehensive security audits of their learning management systems to identify potential exploitation vectors.
The remediation strategy should prioritize immediate plugin updates to versions that address the file validation issue, as this represents the most direct solution to the vulnerability. Security administrators should also implement additional defensive measures such as restricting file upload capabilities, implementing strict file type whitelisting, and monitoring file upload activities for suspicious patterns. Network segmentation and web application firewalls can provide additional layers of protection against exploitation attempts. Regular security assessments and vulnerability scanning should be conducted to ensure that similar issues are not present in other components of the educational technology stack, as the MasterStudy LMS Pro plugin represents just one potential entry point for attackers targeting educational institutions.