CVE-2026-80067: MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter
MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MasterStudy LMS WordPress Pluginto a version that resolves this vulnerability.Fixed in 3.7.50
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Subscriber-level access or higher. No user interaction is required.
What does an attacker need to make exploitation useful?
The attacker must be able to reference a reachable WXR XML file using directory traversal sequences in the stm_lms_step parameter. The imported WXR content can then be published under the attacker’s identity with attacker-chosen post type, title, content, and metadata.
Are installations running the default vulnerable plugin behavior affected?
The affected AJAX action lacks capability checks and nonce verification, so Subscriber-level accounts can reach it without those protections. The issue affects MasterStudy LMS versions before 3.7.50.
How can I determine whether my site is affected?
Check the installed MasterStudy LMS plugin version; versions earlier than 3.7.50 are affected. Review activity associated with the stm_lms_import_sample_data AJAX action and look for unexpected posts published under low-privilege user accounts.