CVE-2026-80069: MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax
MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via cross-site request forgery to cause an uncaught PHP fatal error that, when displayerrors is enabled, discloses the absolute filesystem path of the plugin.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MasterStudy LMS WordPress Pluginto a version that resolves this vulnerability.Fixed in 3.7.50
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user can trigger the affected AJAX action, including users with the Subscriber role. An attacker does not need elevated plugin or administrative capabilities.
What conditions are required for information disclosure?
The attacker must be able to send a request to the stm_lms_send_test_email_ajax action. Disclosure of the plugin's absolute filesystem path occurs when the resulting uncaught PHP fatal error is displayed, which requires PHP display_errors to be enabled.
Can this be exploited through CSRF?
Yes. Because the handler lacks nonce validation, an attacker can trigger it directly or through a cross-site request forgery request against an authenticated user.
What versions are affected?
MasterStudy LMS versions before 3.7.50 are affected. Updating to version 3.7.50 or later addresses the identified vulnerable version range.