An unauthenticated path traversal vulnerability in the Stylemix MasterStudy LMS plugin allows remote attackers to delete arbitrary files on the server, posing a significant risk to site integrity.

This flaw is classified as a CWE-22 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). It allows an unauthenticated attacker to manipulate file paths and trigger the deletion of files outside the intended directory, potentially leading to a complete denial of service or site corruption.

Successful exploitation of this vulnerability could lead to the deletion of critical system or application files, resulting in severe service disruption and site unavailability. With a CVSS score of 8.6, this is a high-severity issue because it requires no authentication and can be exploited over the network with low complexity.

Immediate Action: Update the WordPress MasterStudy LMS plugin to version 3.7.43 or later to apply the necessary security patch.

Proactive Monitoring: Review web server and WordPress access logs for unusual requests targeting file paths or attempts to access restricted system directories.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block path traversal sequences, such as dot-dot-slash patterns, to mitigate potential exploitation attempts.

Public Exploit Available: No confirmed public exploit in the available data.

Given the high CVSS score and the ease of exploitation, immediate action is required to secure affected installations. System administrators should prioritize updating the plugin to the latest version to prevent potential site destruction by unauthorized actors.