CVE-2025-7438

Name of the Vulnerable Software and Affected Versions MasterStudy LMS Pro versions up to and including 4.7.9

Description The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the install and activate plugin function. This allows authenticated attackers with Subscriber-level access and above to upload arbitrary files to the affected server, potentially leading to remote code execution. Exploitation is difficult due to timing requirements and environmental factors.

Recommendations MasterStudy LMS Pro versions prior to and including 4.7.9: Update to a version newer than 4.7.9.