Path Traversal in MasterStudy LMS WordPress Plugin

Executive Summary

This vulnerability is a path traversal flaw in the MasterStudy LMS WordPress plugin before version 3.7.50. Authenticated Subscriber-level users can exploit the stm_lms_step parameter in the stm_lms_import_sample_data AJAX action to traverse the file system and import arbitrary WXR XML files. The plugin lacks capability checks and nonce verification, allowing attackers to publish posts under their identity with attacker-controlled content and metadata.

Useful 0 Not Useful 0

Detection Guidance

Check WordPress sites running MasterStudy LMS plugin versions before 3.7.50. Look for unauthorized AJAX calls to stm_lms_import_sample_data with stm_lms_step parameter containing path traversal sequences like ../. Inspect server logs for suspicious WXR file imports or unexpected post creations by Subscriber-level users.

Useful 0 Not Useful 0

Impact Analysis

An attacker with Subscriber access could upload malicious or unauthorized content to your WordPress site, publish posts under their identity, and manipulate site data. This could lead to defacement, misinformation, or unauthorized access to sensitive information if combined with other vulnerabilities.

Useful 0 Not Useful 0

Mitigation Strategies

Update MasterStudy LMS plugin to version 3.7.50 or later immediately. Remove write permissions for Subscriber-level users if not required. Monitor for unauthorized post creations and review recent plugin activity logs for signs of exploitation.

Useful 0 Not Useful 0