CVE-2026-80067 in MasterStudy LMS Plugin
Summary
by MITRE • 10/29/2026
MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in MasterStudy LMS plugin for WordPress prior to version 3.7.50 represents a critical security flaw rooted in insufficient input validation and inadequate access control mechanisms within the application's data import functionality. Specifically, the defect resides in the handling of the stm_lms_step parameter during the execution of the stm_lms_import_sample_data AJAX action. This endpoint is designed to facilitate the importing of sample learning management system data but fails to enforce proper capability checks or verify nonces, which are standard WordPress security measures intended to prevent unauthorized actions and cross-site request forgery attacks. The absence of these safeguards allows authenticated users with even the most basic Subscriber-level privileges to manipulate the import process in unintended ways.
At a technical level, the core issue is a path traversal vulnerability that enables attackers to bypass expected file system boundaries. By injecting directory traversal sequences such as dot-dot-slash into the stm_lms_step parameter, an attacker can redirect the import handler away from its intended scope and reference arbitrary WXR XML files located elsewhere on the server's file system or accessible via other means. This manipulation exploits the lack of sanitization on user-supplied input that dictates which data source is processed. Because the application does not validate whether the referenced file resides within an approved directory structure, it proceeds to parse and process any reachable XML document provided by the attacker.
The operational impact of this vulnerability is significant as it leads directly to unauthorized content injection into the WordPress environment. Once a malicious WXR file is successfully imported through this mechanism, its contents are published under the identity of the authenticated user who initiated the request. This means that an attacker can control critical aspects of the newly created posts, including the post type, title, body content, and associated metadata. In the context of a Learning Management System, this could result in the publication of fraudulent course materials, misleading educational content, or potentially malicious scripts embedded within the post data if not properly sanitized by subsequent filters. This undermines the integrity of the learning platform and can damage institutional reputation while confusing students and administrators alike.
From a classification perspective, this vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, as it involves using external input to access files outside of restricted directories. Additionally, because it allows an authenticated low-privilege user to perform administrative-like actions such as publishing content without proper authorization checks, it also relates to CWE-862 Missing Authorization and CWE-913 Improper Control of Dynamically-Managed Resources. In terms of the MITRE ATT&CK framework for enterprise security, this behavior corresponds to techniques involving resource hijacking or unauthorized data manipulation, specifically falling under tactics related to persistence or impact depending on how the injected content is utilized by subsequent actors who might exploit these fake posts further.
To mitigate this vulnerability, immediate action should be taken to upgrade the MasterStudy LMS plugin to version 3.7.50 or later where these security flaws have been addressed. For organizations unable to update immediately due to compatibility concerns, implementing a Web Application Firewall with rules specifically targeting path traversal attempts in AJAX parameters can provide temporary protection. Furthermore, developers and administrators should ensure that all custom code adheres strictly to WordPress coding standards by validating user capabilities using functions like current_user_can before processing sensitive actions and verifying nonces via check_admin_referer or wp_verify_nonce to prevent unauthorized state changes. Regular security audits of third-party plugins are essential to identify similar patterns of insufficient input validation across the entire technology stack.