Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-5060— MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion

Quick assessment

Affected
stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress MasterStudy是WordPress基金会开源的一个学习管理系统组件。 WordPress MasterStudy 3.7.14及之前版本存在授权问题漏洞，该漏洞源于stm_lms_delete_cover()函数缺少对file_id参数的所有权验证，导致不安全的直接对象引用，可能使具有Instructor级别及以上权限的认证攻击者通过枚举附件ID删除任意用户的附件。

CVSS 6.5 · Medium EPSS 0.39% · P30

Possible ATT&CK Techniques 1 AI

T1135 · Network Share Discovery

Affected Version Matrix 1

VendorProduct Version RangeStatus
stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education ≤ 3.7.23 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-5060

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion
Source: CVE Program / CVE List V5
Vulnerability Description
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the `stm_lms_delete_cover()` function lacking ownership validation on the `file_id` parameter before passing it to `wp_delete_attachment()`. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary attachments belonging to any user by enumerating sequential attachment IDs.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress MasterStudy 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress MasterStudy是WordPress基金会开源的一个学习管理系统组件。 WordPress MasterStudy 3.7.14及之前版本存在授权问题漏洞，该漏洞源于stm_lms_delete_cover()函数缺少对file_id参数的所有权验证，导致不安全的直接对象引用，可能使具有Instructor级别及以上权限的认证攻击者通过枚举附件ID删除任意用户的附件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education 0 ~ 3.7.23 -

II. Public POCs for CVE-2026-5060

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-5060

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-5060 (1)

IV. Related Vulnerabilities

Same product: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Same vendor: stylemix
Same weakness: CWE-639

V. Comments for CVE-2026-5060

No comments yet

Leave a comment