WordPress MasterStudy LMS IDOR Arbitrary Deletion (CVE-2026-5060) Advisory

Vulnerability Overview Vulnerability Name: MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion CVE ID: CVE-2026-5060 CVSS Score: 6.5 (Medium) Release Date: July 28, 2026 Last Updated: July 29, 2026 Researchers: Md. Moniruzzaman Prodhun (NomanProdhun) - Knight Squad Affected Scope Software Type: Plugin Software Slug: masterstudy-lms-learning-management-system Affected Versions: <= 3.7.23 Fixed Versions: 3.7.24 Remediation Recommendation: Upgrade to version 3.7.24 or higher. Vulnerability Description The vulnerability exists in the MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin, versions <= 3.7.14. Due to the function lacking ownership validation for the parameter, an attacker can delete arbitrary attachments from any user by enumerating sequential attachment IDs. Reference Links plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Authorization Bypass via User-Controlled Key: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Recently Discovered Vulnerabilities: - CVE-2026-57330: Stored Cross-Site Scripting - CVE-2026-57640: Missing Authorization - CVE-2026-42730: SQL Injection - CVE-2026-40766: SQL Injection - CVE-2026-4817: Time-based Blind SQL Injection via order and orderby Parameters - CVE-2026-6559: Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode - CVE-2025-13766: Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion - CVE-2025-64366: SQL Injection - CVE-2025-59575: Sensitive Information Exposure - CVE-2025-59577: Race Condition to Multiple Reviews Disclaimer This record contains copyrighted material. Copyright: 2012-2026 Defiant Inc. and 1999-2026 The MITRE Corporation. Contact Information For adding information or reporting errors, please contact: wfsupport@wordfence.com Additional Services Wordfence Intelligence: Offers free personal and commercial API access to the WordPress vulnerability database. Wordfence WordPress Plugin: Immediately notifies websites if they are affected by new vulnerabilities. Footer Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays). Response Time: Customer support is available 24 hours a day, 365 days a year. Legal Statement Terms and Conditions, Privacy Policy and Notice, Do Not Sell or Share My Personal Information. Social Media Twitter, Facebook, LinkedIn, Instagram Products and Support Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Documentation, Learning Center, Free Support, Premium Support News and About Blog, News, Vulnerability Advisories, About Wordfence, Affiliate Program, Careers, Contact, Security, CVE Request Form Newsletter Subscription Subscribe for news and updates from a team of experienced security professionals. Copyright © 2012-2026 Defiant Inc. All Rights Reserved.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress MasterStudy LMS IDOR Arbitrary Deletion (CVE-2026-5060) Advisory

More from this source