Read the docs
TI-2026-82430 Aliases CVE-2026-80067GHSA-w23g-3684-c4x8

MasterStudy LMS WordPress Plugin Path Traversal via stm_lms_step Parameter

Priority LOW 25CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability in the stm_lms_step parameter of the stm_lms_import_sample_data AJAX action. The action lacks capability checks and nonce verification, so authenticated Subscriber-level users can supply directory traversal sequences to import arbitrary WXR XML files. An attacker can reference a reachable WXR file and have the handler publish its posts under their identity, with attacker-chosen post type, title, content and metadata.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00585 48th percentileScored 2026-11-07
Fix Fixed MasterStudy LMS WordPress Plugin (Stylemix): 3.7.50

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
StylemixThemesMasterStudy LMS WordPress Pluginbefore 3.7.503.7.50Patch availableCNA
  • MasterStudy LMS WordPress Plugin VendorStylemixThemes Affected before 3.7.50 Fixed in 3.7.50 Patch available CNA

Remediation

Update the MasterStudy LMS WordPress plugin to version 3.7.50 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA MasterStudy LMS WordPress Plugin (Stylemix) Fixed in 3.7.50

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Stylemix MasterStudy LMS WordPress Plugin 3.7.50

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-82431 Missing authorization in MasterStudy LMS WordPress plugin exposes file pathsPriority LOW 24
    Show all 2 records →

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-80067
  2. 2026-10-29 Alias added: GHSA-w23g-3684-c4x8
  3. 2026-10-29 CISA SSVC decision points changed

References

Patch 1

Other 1

  • TI-2024-01413 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection CVSS 3.1CRITICAL 9.8
  • TI-2022-00364 MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation CVSS 3.1CRITICAL 9.8
  • TI-2024-24620 WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2023-02655 BookIt <= 2.3.7 - Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2024-05535 MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor CVSS 3.1CRITICAL 9.1
  • TI-2024-24618 WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Unauthenticated Local File Inclusion vulnerability CVSS 3.1CRITICAL 9.8
See all 172 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences