Threat Entry Updated 2025-07-22

CVE-2025-7438 - Masterstudy Lms Pro Plugin

The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'install_and_activate_plugin' function in all versions up to, and including, 4.7.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability is difficult to exploit due to timing requirements and environmental factors.

PLUGIN Masterstudy Lms Pro

CVE-2025-7438

HIGH CVSS 7.5 2025-07-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-28

CVE-2025-4800 - Masterstudy Lms Pro Plugin

The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stm_lms_add_assignment_attachment function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.

PLUGIN Masterstudy Lms Pro

CVE-2025-4800

HIGH CVSS 8.8 2025-05-28

Risk Score

Open Full Technical Breakdown