Skip to content
Sign in
7.5 High

CVE-2025-7438 The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type…

Description

The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'install_and_activate_plugin' function in all versions up to, and including, 4.7.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability is difficult to exploit due to timing requirements and environmental factors.

Affected products and versions

Product Affected versions Fixed in
MasterStudy LMS Pro 4.7 earliest → 4.7.9 No fix stated

Other CVEs of MasterStudy LMS Pro

The 7 CVEs of MasterStudy LMS Pro →
CVE-2025-64215 Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro allows Accessing Functionality Not Properly… 6.5 Medium CVE-2026-8653 The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter… 6.5 Medium CVE-2025-64214 Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro… 7.5 High CVE-2025-64213 Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes MasterStudy LMS Pro… 7.5 High
Track this CVE