CVE-2026-5060

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin – for Online Courses and Education versions prior to 3.7.15

Description An Insecure Direct Object Reference exists when the stm lms delete cover() function fails to validate ownership of the file id parameter before it is processed by wp delete attachment(). This allows authenticated users with Instructor-level access or higher to delete arbitrary attachments belonging to any user by enumerating sequential attachment IDs.

Recommendations Update the plugin to a version newer than 3.7.14. As a temporary mitigation, restrict access to the stm lms delete cover() function for users with Instructor-level permissions until the update is applied.