CVE-2026-80069 in MasterStudy LMS Plugin
Summary
by MITRE • 10/29/2026
MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via cross-site request forgery to cause an uncaught PHP fatal error that, when display_errors is enabled, discloses the absolute filesystem path of the plugin.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in MasterStudy LMS for WordPress prior to version 3.7.50 represents a critical failure in access control mechanisms within the application's AJAX handling infrastructure. Specifically, the stm_lms_send_test_email_ajax action is exposed without implementing necessary authorization checks or nonce validation. This architectural flaw permits any authenticated user, regardless of their assigned role such as Subscriber, to invoke this specific endpoint directly through HTTP requests. The absence of capability verification means that low-privilege users can execute administrative-level functions intended for higher-tier roles like Administrators or Instructors, fundamentally breaking the principle of least privilege and allowing unauthorized operational access within the WordPress environment.
From a technical perspective, the core issue lies in the lack of input validation and state management during the execution of the email sending routine. When an attacker triggers this action via cross-site request forgery or direct API calls, the script attempts to process parameters that may be malformed or missing due to the bypassed security controls. This improper handling leads to a null pointer dereference or similar logic error within the PHP codebase, resulting in an uncaught fatal exception. The severity of this technical flaw is significantly amplified by server configuration settings; if the WordPress installation has display_errors enabled, which is common in development environments but sometimes persists in production due misconfiguration, the system will output detailed stack traces to the client response.
The operational impact of this vulnerability extends beyond simple denial of service or functional disruption. The primary risk associated with triggering this uncaught PHP fatal error is information disclosure. When the server returns the full stack trace containing the absolute filesystem path of the plugin, it provides attackers with precise knowledge of the underlying directory structure on the web server. This local file system exposure serves as a critical reconnaissance step for subsequent attacks. Knowledge of the exact installation paths allows adversaries to craft more effective Local File Inclusion payloads or predict locations for other sensitive files such as configuration databases and backup archives. Furthermore, the ability to trigger errors at will can be leveraged in denial-of-service scenarios by consuming server resources through repeated malicious requests aimed at crashing specific PHP processes.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting a failure to enforce proper authorization checks before allowing access to sensitive functions. Additionally, the mechanism of invoking actions via forged requests maps directly to MITRE ATT&CK technique T1566.002 Cross-Site Request Forgery. The disclosure of filesystem paths through error messages corresponds to CWE-209 Generation of Error Message Containing Sensitive Information and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. These classifications highlight the dual nature of the flaw as both a control bypass and an information leakage vector, requiring immediate remediation to prevent exploitation in live environments where such misconfigurations may exist.
Mitigation strategies must focus on enforcing strict access controls and improving error handling protocols within the application codebase. The most effective solution is to upgrade the MasterStudy LMS plugin to version 3.7.50 or later, which addresses these authorization gaps by implementing proper capability checks for all AJAX actions involving administrative functions. Developers should ensure that nonce validation is applied consistently across all state-changing operations to prevent cross-site request forgery attacks. Additionally, server administrators must verify that display_errors is set to false in production environments to suppress detailed stack traces from being returned to end-users. Implementing a Web Application Firewall can also provide an additional layer of defense by detecting and blocking anomalous AJAX requests or known exploit patterns associated with this specific vulnerability before they reach the application logic.