CVE-2025-32141: MasterStudy LMS File Inclusion Vulnerability

CVE-2025-32141 Overview

CVE-2025-32141 is a PHP Local File Inclusion (LFI) vulnerability in the Stylemix MasterStudy LMS plugin for WordPress. The flaw stems from improper control of filenames used in PHP include or require statements [CWE-98]. Affected versions include MasterStudy LMS from n/a through 3.5.28. An authenticated attacker with low privileges can include arbitrary local PHP files, leading to code execution within the web application context. The vulnerability was published to the National Vulnerability Database (NVD) on April 4, 2025.

Critical Impact
A low-privileged attacker can trigger PHP Local File Inclusion over the network, resulting in high impact to confidentiality, integrity, and availability of the WordPress site.

Affected Products

Stylemix MasterStudy LMS (masterstudy-lms-learning-management-system) versions up to and including 3.5.28
WordPress sites running vulnerable plugin builds
Hosting environments exposing the plugin's PHP endpoints to authenticated users

Discovery Timeline

2025-04-04 - CVE-2025-32141 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32141

Vulnerability Analysis

The vulnerability resides in the MasterStudy LMS WordPress plugin, which fails to sanitize user-controlled input passed to PHP file inclusion statements. When a request reaches a vulnerable handler, the plugin constructs a file path using attacker-influenced data and passes it directly to include or require. This allows the attacker to load arbitrary .php files present on the server. Successful exploitation yields code execution in the context of the PHP worker, which can be chained with file upload primitives or log poisoning to achieve full Remote Code Execution. The vulnerability requires authentication, but the privilege level needed is low, which is consistent with many WordPress LMS deployments that permit student or instructor registration.

Root Cause

The root cause is improper control of filename for include/require statement [CWE-98]. The plugin trusts request parameters when resolving template or module paths without enforcing an allowlist or canonicalizing the resulting path. Path traversal sequences such as ../ are not stripped before the include resolves, enabling access to files outside the intended directory.

Attack Vector

The attack vector is network-based and requires a valid low-privileged account on the target WordPress site. The attacker submits a crafted HTTP request to a vulnerable plugin endpoint, supplying a parameter that influences the included file path. The included file is then parsed and executed by the PHP runtime. Refer to the Patchstack Vulnerability Report for additional context.

Detection Methods for CVE-2025-32141

Indicators of Compromise

HTTP requests to MasterStudy LMS endpoints containing path traversal sequences such as ../ or encoded variants like %2e%2e%2f
Unexpected PHP processes spawning shell commands or writing to web-accessible directories
New or modified PHP files within the wp-content/uploads/ directory paired with subsequent inclusion attempts
Web server logs showing parameters referencing absolute paths like /etc/passwd or wp-config.php

Detection Strategies

Inspect WordPress access logs for requests to MasterStudy LMS handlers containing suspicious file path parameters
Enable PHP error logging and alert on include()/require() warnings referencing unexpected paths
Apply a Web Application Firewall (WAF) signature for LFI patterns targeting masterstudy-lms-learning-management-system
Correlate authenticated low-privilege session activity with plugin endpoint access anomalies

Monitoring Recommendations

Monitor outbound connections from the PHP worker process for signs of post-exploitation tooling
Track integrity of wp-content/plugins/masterstudy-lms-learning-management-system/ files using file integrity monitoring
Audit registered WordPress users for unexpected account creation that could be used to authenticate to the LFI endpoint

How to Mitigate CVE-2025-32141

Immediate Actions Required

Update MasterStudy LMS to a version newer than 3.5.28 once a patched release is available from Stylemix
Restrict new user registration on affected WordPress sites until the plugin is patched
Review WordPress account roles and remove unnecessary low-privilege accounts that could be abused
Audit recent web server logs for prior exploitation attempts against the plugin

Patch Information

Consult the Patchstack Vulnerability Report for vendor patch status and apply the fixed version of masterstudy-lms-learning-management-system as soon as it is released. Verify the plugin version in the WordPress admin dashboard after update.

Workarounds

Deploy WAF rules that block path traversal sequences in requests targeting MasterStudy LMS endpoints
Set the PHP open_basedir directive to confine include operations to the WordPress installation directory
Disable the MasterStudy LMS plugin until a vendor patch is applied if business operations permit

bash

# Example php.ini hardening to limit file inclusion scope
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off