Missing Authorization Vulnerability in MasterStudy LMS Plugin for WordPress
CVE-2026-80069
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 29 October 2026
What is CVE-2026-80069?
The MasterStudy LMS plugin prior to version 3.7.50 for WordPress contains a critical flaw that permits any authenticated user, including those with minimal permissions such as Subscribers, to invoke the stm_lms_send_test_email_ajax AJAX action without proper authorization checks. This vulnerability allows malicious actors to exploit the system either directly or through cross-site request forgery, potentially resulting in an uncaught PHP fatal error. If display_errors is enabled, this can expose the absolute filesystem path of the plugin, presenting further security risks for the affected application and server.
Affected Version(s)
MasterStudy LMS WordPress Plugin 0 < 3.7.50