Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-80067— MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter

Quick assessment

Affected
Stylemix MasterStudy LMS WordPress Plugin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 MasterStudy LMS 插件在 3.7.50 版本之前存在路径遍历漏洞。该漏洞允许已认证的订阅者（Subscriber）级别用户，通过在传递给 AJAX 操作的 参数中注入目录遍历序列，导入任意的 WXR XML 文件。由于该操作缺少权限检查和非斯（nonce）验证，攻击者可遍历文件系统以引用可访问的 WXR 文件，并让处理程序以攻击者身份发布其中包含的文章。这使得攻击者能够发布其自定义的文章类型、标题、内容及元数据。

CVSS 5.4 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80067

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Stylemix MasterStudy LMS WordPress Plugin 0 ~ 3.7.50 -

II. Public POCs for CVE-2026-80067

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80067

请登录查看更多情报信息。

Other References for CVE-2026-80067 (3)

IV. Related Vulnerabilities

Same product: MasterStudy LMS WordPress Plugin
Same vendor: Stylemix
Same weakness: CWE-22