EUVD-2026-85801
GHSA-99q4-525f-whh5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor+ account
-
DeliverySet malicious display-style value
-
ExploitTrigger template path build
-
ExecutionInclude arbitrary local PHP file
-
ImpactExecute code on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with the Contributor role or higher on a site running MasterStudy LMS between 3.5.29 and before 3.7.50. The attacker abuses one specific display-style setting that is not validated before being used to construct a template path, causing the plugin to include and execute an arbitrary local PHP file; achieving code execution therefore depends on a suitable PHP file existing on the server (e.g., an uploaded or pre-planted file). Limiting factors: exploitation is not possible without a contributor-or-above account, so sites that do not allow untrusted user registration at that level are far less exposed; SSVC marks it non-automatable, indicating manual exploitation rather than mass scanning. |
| Impact | This is a genuine high-priority issue but not an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) rates local-file-inclusion leading to arbitrary PHP execution, yielding total CIA impact - consistent with the SSVC 'Technical Impact: total' judgment. However, the vector's PR:H conflicts with the description, which states exploitation only requires the Contributor role 'and above'; a Contributor is a low-privilege authenticated WordPress user, so PR:L is more accurate and would raise the true base score to ~8.8. A public exploit exists (WPScan) and a vendor patch is available, but SSVC records 'Exploitation: none' and 'Automatable: no', and there is no CISA KEV listing and no EPSS score in the input - signals that align with no confirmed active exploitation and manual, account-dependent abuse rather than mass scanning. Net: prioritize patching because the technical impact is full server-side code execution and a POC is public, but the authenticated (Contributor+) prerequisite and non-automatable nature bound real-world exposure to sites that grant untrusted users contributor accounts. |
| Exploit ScenarioDerived | An attacker who holds (or registers/obtains) a Contributor-level account on a MasterStudy LMS site manipulates the unvalidated display-style setting so it resolves to a path pointing at an attacker-controlled or pre-planted local PHP file, which the plugin then includes and executes on the server. Because a public exploit is available via WPScan and the attack vector is network with low complexity, weaponization is straightforward once contributor access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Authenticated local file inclusion and code execution affects the MasterStudy LMS WordPress plugin in versions from 3.5.29 up to (but not including) 3.7.50, where one display-style setting is used to build a template path without validation. Exploitation requires an authenticated WordPress account with the Contributor role or higher, and turns into arbitrary PHP execution only when a suitable PHP file already exists on the server. Publicly available exploit code exists (WPScan), but there is no confirmed active exploitation (not in CISA KEV) and SSVC rates exploitation as none and non-automatable, making this a high-priority, manually driven issue rather than an emergency; this is especially true for sites that do not permit untrusted users to register at Contributor level or above.
RemediationAI
The primary fix is to upgrade the MasterStudy LMS WordPress plugin to 3.7.50 or later, which is the vendor-released patched version that closes this template-path inclusion; because the flaw sits on a path that a previous release already claimed to fix, verify the running version rather than trusting an earlier update, and consult the WPScan advisory at https://wpscan.com/vulnerability/fffc0d8c-256e-417d-b76c-251948b9f1ed/ for confirmation. Until patching is possible, restrict who can hold the Contributor role or above: disable open registration and any workflow that grants Contributor+ to untrusted users, and audit existing accounts at that level, accepting that legitimate contributor workflows will be disrupted - this directly removes the requirement for exploitation, since SSVC marks the issue non-automatable and dependent on an authenticated Contributor account. Additionally, reduce the availability of attacker-influenceable PHP files on the server (for example, prevent non-administrative file uploads of PHP content and remove orphaned or uploaded .php files from web-accessible directories), since code execution depends on a suitable local PHP file being present; a WAF or server rule that rejects traversal sequences in request parameters is a useful secondary layer but will not stop exploitation that reaches the vulnerable include through normal WordPress request handling.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal) manifesting as a local file inclusion. The plugin takes one of its 'display-style' settings and concatenates it into a template path without validating or whitelisting the value, then passes the resulting path to a PHP include-style construct. Because the value is not constrained to a known template directory or allowed template name, an attacker who can set that option can steer the include to an arbitrary local PHP file, executing it in the web server's context. The pattern is notable because the description states an equivalent path was corrected in an earlier release while this parallel one was missed, so the current fix appears to close an incomplete prior remediation rather than a brand-new class of bug. The assigned CPE (cpe:2.3:a:unknown:masterstudy_lms_wordpress_plugin:*:*:*:*:*:*:*:*) carries a wildcard version and an unconfirmed vendor key, so version scoping must rely on the EUVD range (3.5.29 before 3.7.50) rather than the CPE. The vendor's own CVSS vector (AV:N/AC:L/PR:H) and the independent assessment (AV:N/AC:L/PR:L) agree on network reachability and high confidentiality/integrity/availability impact, but differ over the privilege level needed; the independent assessment's PR:L is treated here as authoritative, meaning a low-privileged Contributor account is sufficient.
Know when Masterstudy Lms Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Description says Contributor role suffices, a low-privilege authenticated user, so PR:L (not PR:H); LFI achieving PHP execution gives full confidentiality, integrity and availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed.
Technical POC Analysis
CWE-22 (path traversal) that manifests as local file inclusion in the MasterStudy LMS WordPress plugin (masterstudy-lms-learning-management-system), specifically in the Elementor Courses Categories W…
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A code-execution flaw in the MasterStudy LMS WordPress plugin (CVE-2026-88843) allows someone holding a Contributor-level account on a course or training site to escalate into running arbitrary code on the underlying web server when a suitable PHP file is already present. Because MasterStudy drives course catalogs, enrollment and student-facing content, a successful compromise could expose learner records and take education or training portals offline. Publicly available exploit code exists and the vulnerability has not been added to CISA's KEV catalog, so this is a priority patch cycle rather than an emergency, with materially lower exposure for sites that do not grant Contributor access to untrusted users.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes the titles and IDs of a
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin (all versions before 3.7.46) exposes per-stud
Unauthenticated account creation in the MasterStudy LMS WordPress plugin (versions 2.3.0 through before 3.7.50) lets rem
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes learning statistics for
Payment verification bypass in MasterStudy LMS WordPress Plugin before 3.7.40 permits unauthenticated attackers to fraud
Open redirect in MasterStudy LMS WordPress Plugin before version 3.7.43 enables unauthenticated attackers to supply an u
Missing authorization checks in the MasterStudy LMS WordPress plugin before 3.7.50 let any authenticated user - includin
Any authenticated WordPress user - down to the lowest-privilege Subscriber role - can invoke an administrative maintenan
Broken object-level authorization in MasterStudy LMS WordPress Plugin before 3.7.46 exposes course sales records of any
Cross-instructor content tampering in MasterStudy LMS WordPress Plugin before 3.7.46 allows authenticated instructor-rol
Broken object-level authorization in the MasterStudy LMS WordPress plugin before 3.7.50 lets an authenticated user holdi
Instructors in MasterStudy LMS WordPress Plugin versions before 3.7.46 can read quiz questions, correct answers, and exp
Exploit-DB