What is the CVSS score of CVE-2026-78284?

CVE-2026-78284 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of MasterStudy LMS are affected by CVE-2026-78284?

The MasterStudy LMS WordPress plugin (versions 3.7.42 and earlier) contains an unauthenticated remote file deletion vulnerability (CVSS 8.6) that allows any internet user to delete arbitrary server…

How to fix or mitigate CVE-2026-78284?

Within 24 hours, inventory all WordPress deployments running MasterStudy LMS version 3.7.42 or earlier and identify which are internet-accessible. Within 7 days, either completely disable and deactivate the plugin if operational requirements permit, or implement a Web Application Firewall rule to block requests to the vulnerable plugin paths, enforce restrictive file permissions to prevent the web server process from writing to system and sensitive application directories, and enable file integrity monitoring on critical directories. Within 30 days, evaluate whether a patched version of the plugin exists or identify and migrate to an alternative LMS solution, document the final remediation approach, and establish a plugin security review process to prevent future deployment of vulnerable software.

MasterStudy LMS CVE-2026-78284

EUVD-2026-65159 HIGH

Path Traversal (CWE-22)

2026-08-24 Patchstack

GHSA-349j-547x-3rj9

Path Traversal Masterstudy Lms

8.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

9.3 CRITICAL

Network-accessible unauthenticated path traversal with scope change; I:L added over the official I:N because deleting wp-config.php constitutes measurable integrity loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 24, 2026 - 22:21 vuln.today

CVE Published

Aug 24, 2026 - 21:31 cve.org

HIGH 8.6

DescriptionCVE.org

Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.

AnalysisAI

Unauthenticated arbitrary file deletion in the MasterStudy LMS WordPress plugin (versions ≤ 3.7.42) allows remote, unauthenticated attackers to delete arbitrary files on the server via path traversal. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:C/A:H) confirms no authentication or user interaction is required and that impact extends beyond the plugin's own scope to server-level files. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site running MasterStudy LMS ≤3.7.42

Delivery

Send unauthenticated HTTP request with path traversal payload in filename parameter

Exploit

Plugin passes unsanitized path to file deletion routine

Execution

Arbitrary server-side file deleted

Impact

WordPress site rendered inoperative or configuration exposed

Access

Identify WordPress site running MasterStudy LMS ≤3.7.42

Delivery

Send unauthenticated HTTP request with path traversal payload in filename parameter

Exploit

Plugin passes unsanitized path to file deletion routine

Execution

Arbitrary server-side file deleted

Impact

WordPress site rendered inoperative or configuration exposed

Vulnerability AssessmentAI

Exploitation	No special conditions are required beyond network access to a WordPress installation with MasterStudy LMS version 3.7.42 or earlier installed and active - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated, low-complexity, remote exploitation against default plugin deployments with no prerequisite configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.6 score is well-supported: network-accessible (AV:N), trivially low complexity (AC:L), no authentication or user interaction required (PR:N/UI:N), scope change (S:C), and high availability impact (A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker scans for WordPress sites running MasterStudy LMS and sends a crafted HTTP request to a vulnerable plugin endpoint, embedding a path traversal sequence (e.g., '../../wp-config.php') in a filename parameter. The plugin passes the unsanitized path to its file deletion function, removing wp-config.php from the server. …
Remediation	Update MasterStudy LMS to any version released after 3.7.42 - consult the plugin's WordPress repository changelog and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-7-42-arbitrary-file-deletion-vulnerability) to confirm the specific patched release, as no exact fix version was present in the provided intelligence. … Detailed patch versions, workarounds, and compensating controls in full report.