CVE-2026-80067 Details
Description
MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata.
A path traversal vulnerability has been identified in the MasterStudy LMS plugin for WordPress, affecting versions prior to 3.7.50. This vulnerability allows authenticated users with Subscriber-level privileges to import arbitrary WXR XML files. Exploitation involves sending directory traversal sequences in the 'stm_lms_step' parameter to the 'stm_lms_import_sample_data' AJAX action, which does not properly validate capabilities or verify nonces. As a result, attackers can navigate the file system to access a WXR file, and the plugin will publish the file's contents as posts under the user's identity. This exploitation can be used to publish posts with selected post types, titles, content, and metadata.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MasterStudy LMS | < 3.7.50 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |