7.5
Élevée
CVE-2025-7438 The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type…
Description
The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'install_and_activate_plugin' function in all versions up to, and including, 4.7.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability is difficult to exploit due to timing requirements and environmental factors.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| MasterStudy LMS Pro 4.7 | premières → 4.7.9 | Pas de correctif indiqué |
Autres CVE de MasterStudy LMS Pro
Les 7 CVE de MasterStudy LMS Pro →
CVE-2025-64215
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro allows Accessing Functionality Not Properly…
6.5
Moyenne
CVE-2026-8653
The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter…
6.5
Moyenne
CVE-2025-64214
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro…
7.5
Élevée
CVE-2025-64213
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes MasterStudy LMS Pro…
7.5
Élevée