CVE-2026-5060

Received Received - Intake

Insecure Direct Object Reference in MasterStudy LMS WordPress Plugin

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Wordfence

Description

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the `stm_lms_delete_cover()` function lacking ownership validation on the `file_id` parameter before passing it to `wp_delete_attachment()`. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary attachments belonging to any user by enumerating sequential attachment IDs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-5060

Affected Vendors & Products

Vendor	Product	Version / Range
masterstudy	masterstudy_lms	to 3.7.14 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the MasterStudy LMS WordPress Plugin. It allows authenticated attackers with Instructor-level access or higher to delete any user's attachments by manipulating the file_id parameter in the stm_lms_delete_cover() function. The plugin fails to validate ownership before passing the file_id to wp_delete_attachment().

Detection Guidance

To detect this vulnerability, check WordPress sites running the MasterStudy LMS plugin versions up to 3.7.14 for unauthorized deletion of attachments. Monitor for unusual activity in the media library or failed access attempts by instructors. No specific commands are provided in the context.

Impact Analysis

An attacker could delete important files such as course materials, user uploads, or other attachments. This could disrupt educational content, cause data loss, or require recovery efforts. The impact is limited to users with Instructor-level access or above exploiting the flaw.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized deletion or exposure of personal data. GDPR requires data integrity and security, while HIPAA mandates protection of health information. Unauthorized deletions may violate these requirements.

Mitigation Strategies

Update the MasterStudy LMS WordPress Plugin to the latest version beyond 3.7.14 to address the insecure direct object reference vulnerability. Ensure only authorized users have Instructor-level access or higher to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-5060. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70