What the vulnerability does
01Description
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the `stm_lms_delete_cover()` function lacking ownership validation on the `file_id` parameter before passing it to `wp_delete_attachment()`. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary attachments belonging to any user by enumerating sequential attachment IDs.
Explanation of Vulnerability in Simple Terms
02Summary
The MasterStudy LMS WordPress plugin versions 3.7.23 and earlier contain an authorization bypass vulnerability. An attacker with low-level user access can modify user-controlled parameters to bypass permission checks and alter data they should not have access to. The vulnerability affects the plugin's core functionality and requires an authenticated account to exploit.
What an attacker can do
03Attacker Capabilities
Modify or delete course data, user records, or settings belonging to other users or the site.
Potential impact on your site
04Site Impact
Unauthorized changes to course content, student records, or plugin settings; potential data loss or course disruption.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account (e.g., student or subscriber role) on the WordPress site.
Key dates
06Disclosure timeline
July 29, 2026
CVE published
July 29, 2026
Record updated
