Executive brief
The MasterStudy LMS plugin for WordPress, which is used to create and manage online education platforms, contains a security flaw that allows unauthorized file deletion. An attacker with an instructor-level account can delete images or documents uploaded by any other user on the site. This could lead to the loss of important course materials, student submissions, or other media assets, potentially disrupting educational operations and damaging the site's reputation.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) within the `stm_lms_delete_cover()` function. The root cause is a lack of ownership validation on the `file_id` parameter before it is passed to the WordPress core function `wp_delete_attachment()`. An authenticated attacker with Instructor-level privileges or higher can exploit this by sending requests with manipulated attachment IDs. By enumerating these IDs, an attacker can delete any media attachment on the WordPress site, regardless of who uploaded it. The issue is addressed in versions following 3.7.14.
Affected products
- StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education up to, and including, 3.7.14
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory
References
- https://plugins.trac.wordpress.org/browser/masterstudy-lms-learning-management-system/tags/3.7.14/_core/lms/classes/user.php
- https://plugins.trac.wordpress.org/browser/masterstudy-lms-learning-management-system/tags/3.7.14/_core/lms/classes/user.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3501788%40masterstudy-lms-learning-management-system%2Ftrunk&old=3496678%40masterstudy-lms-learning-management-system%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/de11c9ad-0b9f-4934-8dc9-dc324d77d702?source=cve