EUVD-2026-50271
GHSA-3wr4-2wwf-jjxw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible via WordPress AJAX; Instructor account required (PR:L); no confidentiality or availability impact, only irreversible integrity loss.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stm_lms_delete_cover() function lacking ownership validation on the file_id parameter before passing it to wp_delete_attachment(). This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary attachments belonging to any user by enumerating sequential attachment IDs.
AnalysisAI
Insecure Direct Object Reference in MasterStudy LMS WordPress Plugin (all versions through 3.7.14) allows authenticated Instructors to permanently delete media attachments belonging to any other WordPress user. The stm_lms_delete_cover() function accepts a caller-supplied file_id and passes it directly to WordPress's wp_delete_attachment() without verifying that the requesting user owns the referenced attachment. Because WordPress stores attachments with sequential integer IDs, an Instructor-level account holder can iterate over IDs to destroy course materials, profile images, or uploaded documents created by students, other instructors, or administrators. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The affected product is the MasterStudy LMS plugin for WordPress, developed by StylemixThemes and identified via CPE cpe:2.3:a:stylemix:masterstudy_lms_wordpress_plugin_-_for_online_courses_and_education:*:*:*:*:*:*:*:*. The root cause is CWE-639 (Authorization Through User-Controlled Key): the application uses a user-supplied integer (file_id) as the sole authorization token for a destructive action, without cross-referencing it against an ownership or permission table. WordPress's wp_delete_attachment() is a powerful core function that permanently removes the attachment post, its metadata, and associated files from disk. Because WordPress auto-increments attachment post IDs sequentially, an attacker with knowledge of any single valid ID can trivially enumerate adjacent IDs to locate and delete attachments owned by other principals. The vulnerable code is visible in the plugin source at _core/lms/classes/user.php around lines 2093-2107 in the 3.7.14 tag.
RemediationAI
A fix has been committed to the plugin's trunk branch on the WordPress Subversion repository (changeset 3501788 at plugins.trac.wordpress.org), but a specific released patched version number has not been independently confirmed from available data - monitor the WordPress plugin page for StylemixThemes and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/de11c9ad-0b9f-4934-8dc9-dc324d77d702 for a confirmed patched release. As an interim compensating control, site administrators can restrict the Instructor role assignment to only fully trusted users, since the attack requires at minimum Instructor-level WordPress authentication - this reduces the attack surface but does not eliminate the vulnerability for sites where instructor self-registration is permitted. Disabling the cover deletion feature via custom code or a firewall rule blocking requests to the stm_lms_delete_cover AJAX action is a more aggressive workaround with the trade-off of breaking legitimate cover management for all instructors. Upgrade to the patched version as soon as it is released and confirmed.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today