PT-2025-30008 · WordPress · Masterstudy Lms Pro

Thái An · Published 2025-07-18 · Updated 2025-07-20 · CVE-2025-7438

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MasterStudy LMS Pro versions up to and including 4.7.9

Description The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the install and activate plugin function. This allows authenticated attackers with Subscriber-level access and above to upload arbitrary files to the affected server, potentially leading to remote code execution. Exploitation is difficult due to timing requirements and environmental factors.

Recommendations MasterStudy LMS Pro versions prior to and including 4.7.9: Update to a version newer than 4.7.9.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-7438

Affected Products

Masterstudy Lms Pro

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-7438 · Security Note
• https://t.me/cvenotify/129406 · Telegram Post
• https://twitter.com/CVEnew/status/1946101824798224620 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1946157717216804942 · Twitter Post
• https://docs.stylemixthemes.com/masterstudy-lms/changelog-pro-version · Note
• https://t.me/cvetracker/28115 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1ab970f5-35d1-43e9-891c-87a2a3e464c6?source=cve · Note
• https://twitter.com/SecAideInfo/status/1946876644355985481 · Twitter Post