MasterStudy LMS CVE-2026-78284

No special conditions are required beyond network access to a WordPress installation with MasterStudy LMS version 3.7.42 or earlier installed and active - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated, low-complexity, remote exploitation against default plugin deployments with no prerequisite configuration. Limiting factors include: the PHP process must have OS-level delete permissions on the target file (standard in shared hosting and many self-managed WordPress installs); the attacker must reference a valid server path (standard WordPress directory structures are publicly documented); and server hardening measures such as PHP open_basedir restrictions, read-only filesystem mounts, or restrictive ACLs on critical files may prevent traversal beyond the webroot even if the plugin endpoint is reached.

The CVSS 8.6 score is well-supported: network-accessible (AV:N), trivially low complexity (AC:L), no authentication or user interaction required (PR:N/UI:N), scope change (S:C), and high availability impact (A:H). The official vector marks I:N, but this may understate reality - deleting wp-config.php constitutes a material integrity loss in addition to an availability disruption, and defenders should treat file deletion as carrying implicit integrity risk. No EPSS score was present in the provided intelligence; however, the absence of any exploitation prerequisite makes automated, at-scale scanning and exploitation technically straightforward once the endpoint is identified. No CISA KEV listing and no public PoC reference appear in the provided data, which are the only factors tempering urgency - the underlying attack class requires no specialized knowledge. Overall, this vulnerability warrants immediate patching: the attack complexity floor is as low as it gets for a network-exposed flaw.

An unauthenticated attacker scans for WordPress sites running MasterStudy LMS and sends a crafted HTTP request to a vulnerable plugin endpoint, embedding a path traversal sequence (e.g., '../../wp-config.php') in a filename parameter. The plugin passes the unsanitized path to its file deletion function, removing wp-config.php from the server. This immediately takes the WordPress site offline and may expose database credentials if backup copies are accessible. No prior foothold, account, or interaction from a site user is required; the attack can be scripted against large numbers of targets. No public PoC has been identified at time of analysis.