Live › vulnerability › CVE-2026-80069
Before version 3.7.50, the MasterStudy LMS plugin for WordPress lets any authenticated user, including Subscribers, call the test-email AJAX handler without a capability or nonce check. The call can cause a PHP fatal error that, when display_errors is on, reveals the server's absolute plugin path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the MasterStudy LMS WordPress plugin before 3.7.50, where any logged-in account (including the lowest Subscriber role) can reach the test-email AJAX action. The exposure is information disclosure of the plugin path, which matters most when PHP error display is on. Sites on a later version or without this plugin can skip it.
No product ranges from the sources yet.
3.7.50.display_errors is enabled in php.ini or the WordPress debug settings.3.7.50 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via cross-site request forgery to cause an uncaught PHP fatal error that, when display_errors is enabled, discloses the absolute filesystem path of the plugin.
This page as .md · .json · in your agent: get_signal("CVE-2026-80069")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.