Vulnerability · Published Oct 29, 2026 · Assigned by VulnCheck

CVE-2026-80067MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter

Medium 5.4

In plain English

A medium-severity path traversal in MasterStudy LMS WordPress Plugin from Stylemix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.6%top 51.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata.

Affected products (as reported)

Vendor	Product	Versions
Stylemix	MasterStudy LMS WordPress Plugin	0 – before 3.7.50

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

Changelog release-notes, patch
WordPress Plugin Download Page product
VulnCheck Advisory: MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter third-party-advisory