# CVE-2026-5060: Stylemix MasterStudy LMS IDOR in stm_lms_delete_cover

Source: https://junglewise.ai/threats/cve-2026-5060-stylemix-masterstudy-lms-idor-in-stm-lms-delete-cover  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-5060 · Severity: medium · CVSS 6.5 · Published 2026-07-29

The MasterStudy LMS plugin for WordPress, which is used to create and manage online education platforms, contains a security flaw that allows unauthorized file deletion. An attacker with an instructor-level account can delete images or documents uploaded by any other user on the site. This could lead to the loss of important course materials, student submissions, or other media assets, potentially disrupting educational operations and damaging the site's reputation.

Technologies: [StylemixThemes MasterStudy LMS](https://junglewise.ai/threats/technologies/masterstudy-lms). Vendors: [StylemixThemes](https://junglewise.ai/threats/vendors/stylemixthemes).

## Quick answers

**Is CVE-2026-5060 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5060 being exploited in the wild.

**How severe is CVE-2026-5060?** Medium severity, with a CVSS score of 6.5, published 29 July 2026.

**Which products and versions are affected?** StylemixThemes MasterStudy LMS up to, and including, 3.7.14.

**Is there a fix for CVE-2026-5060?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5060 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5060?** Check whether you run StylemixThemes MasterStudy LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) within the `stm_lms_delete_cover()` function. The root cause is a lack of ownership validation on the `file_id` parameter before it is passed to the WordPress core function `wp_delete_attachment()`. An authenticated attacker with Instructor-level privileges or higher can exploit this by sending requests with manipulated attachment IDs. By enumerating these IDs, an attacker can delete any media attachment on the WordPress site, regardless of who uploaded it. The issue is addressed in versions following 3.7.14.

## Affected products

- StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education up to, and including, 3.7.14

## Timeline

- 2026-07-29: disclosed
- 2026-07-29: advisory

## References

- [https://plugins.trac.wordpress.org/browser/masterstudy-lms-learning-management-system/tags/3.7.14/_core/lms/classes/user.php](https://plugins.trac.wordpress.org/browser/masterstudy-lms-learning-management-system/tags/3.7.14/_core/lms/classes/user.php)
- [https://plugins.trac.wordpress.org/browser/masterstudy-lms-learning-management-system/tags/3.7.14/_core/lms/classes/user.php](https://plugins.trac.wordpress.org/browser/masterstudy-lms-learning-management-system/tags/3.7.14/_core/lms/classes/user.php)
- [https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3501788%40masterstudy-lms-learning-management-system%2Ftrunk&old=3496678%40masterstudy-lms-learning-management-system%2Ftrunk&sfp_email=&sfph_mail=](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3501788%40masterstudy-lms-learning-management-system%2Ftrunk&old=3496678%40masterstudy-lms-learning-management-system%2Ftrunk&sfp_email=&sfph_mail=)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/de11c9ad-0b9f-4934-8dc9-dc324d77d702?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/de11c9ad-0b9f-4934-8dc9-dc324d77d702?source=cve)

## Related threats

- [StylemixThemes MasterStudy LMS content injection via XSS](https://junglewise.ai/threats/cve-2026-119478-improper-neutralization-of-script-related-html-tags-in-a-web)
- [MasterStudy LMS PHP object injection in subscriber handling](https://junglewise.ai/threats/cve-2026-118090-subscriber-php-object-injection-in-masterstudy-lms-3-7-55)
- [MasterStudy LMS path traversal in file import](https://junglewise.ai/threats/cve-2026-80067-masterstudy-lms-plugin-for-wordpress-before-3-7-50-contains-a)
- [StylemixThemes MasterStudy LMS broken access control](https://junglewise.ai/threats/cve-2026-118092-missing-authorization-vulnerability-in-stylemixthemes)
- [MasterStudy LMS unauthenticated arbitrary file deletion](https://junglewise.ai/threats/cve-2026-78284-masterstudy-lms-unauthenticated-arbitrary-file-deletion)