A critical path traversal vulnerability in the MasterStudy LMS WordPress Plugin allows authenticated users to achieve remote code execution on the underlying server.

The plugin contains a vulnerability in the template path construction logic where user-supplied display-style settings are not properly sanitized. This allows an authenticated user with at least Contributor-level privileges to perform a local file inclusion attack, potentially leading to full server compromise.

The ability to include and execute arbitrary PHP files poses an extreme risk to organizational data and system integrity. An attacker with minimal privileges could gain full control over the WordPress environment, resulting in unauthorized data access, the deployment of malicious backdoors, or total system downtime. Given the CVSS score of 7.2, this vulnerability represents a significant threat to any business relying on this plugin for educational content management.

Immediate Action: Update the MasterStudy LMS WordPress Plugin to version 3.7.50 or later immediately to apply the necessary input validation patches.

Proactive Monitoring: Review web server access logs for anomalous requests targeting template files or unexpected file inclusion patterns. Monitor database and system logs for unauthorized changes to administrative accounts or suspicious file uploads.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests containing directory traversal sequences or suspicious PHP file execution attempts. Ensure that the WordPress file system permissions are hardened to limit the impact if a secondary vulnerability is exploited.

Public Exploit Available: Unknown

The risk of unauthorized code execution through this path traversal vulnerability is severe. Administrators must prioritize updating to version 3.7.50 as the primary remediation step. Failure to update leaves the server environment exposed to potentially malicious actors who can leverage existing Contributor-level credentials to escalate their access and compromise the entire hosting infrastructure.