Live › vulnerability › CVE-2026-80067
Before version 3.7.50, the MasterStudy LMS plugin for WordPress lets any logged-in Subscriber-level user use directory traversal in the stm_lms_step parameter to import arbitrary WXR XML files. The import handler lacks capability and nonce checks, so an attacker can publish attacker-chosen posts, titles, content and metadata under their own identity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the MasterStudy LMS plugin for WordPress before 3.7.50 are exposed. The attacker needs any authenticated Subscriber-level account, so sites with open registration or many low-privilege users carry more risk than sites with closed user lists.
No product ranges from the sources yet.
wp plugin get masterstudy-lms-learning-management-system --field=version if WP-CLI is available.3.7.50 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata.
This page as .md · .json · in your agent: get_signal("CVE-2026-80067")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.