CVE-2026-5060: MasterStudy LMS Auth Bypass Vulnerability

CVE-2026-5060 Overview

CVE-2026-5060 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the MasterStudy LMS WordPress Plugin – for Online Courses and Education. All versions up to and including 3.7.14 are affected. The flaw resides in the stm_lms_delete_cover() function, which fails to validate ownership of the file_id parameter before passing it to wp_delete_attachment(). Authenticated attackers with Instructor-level access or above can delete arbitrary attachments belonging to any user by enumerating sequential attachment IDs. The issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

Critical Impact
Authenticated instructors can delete arbitrary WordPress media attachments across the site, resulting in data loss and broken site content.

Affected Products

MasterStudy LMS WordPress Plugin – for Online Courses and Education, versions ≤ 3.7.14
WordPress sites using MasterStudy LMS with Instructor-level or higher user roles enabled
Learning management deployments relying on the plugin's attachment cover deletion workflow

Discovery Timeline

2026-07-29 - CVE-2026-5060 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-5060

Vulnerability Analysis

The vulnerability exists inside the stm_lms_delete_cover() function within the plugin's user class (see references to user.php lines 2093 and 2107). The function accepts a file_id parameter from an authenticated request and forwards it directly to WordPress's wp_delete_attachment() API. No verification confirms that the calling user owns the attachment referenced by file_id. Because WordPress attachment IDs are sequential integers, an attacker can iterate through IDs and delete any media object stored in the site's library. The CWE-639 classification reflects the authorization gap where the object identifier is trusted without a matching ownership check.

Root Cause

The root cause is missing authorization on a user-controlled object identifier. The plugin verifies that the caller holds an Instructor role but does not verify that the target attachment belongs to that instructor. WordPress's wp_delete_attachment() performs the deletion whenever the caller has upload capabilities, so the plugin's role gate is insufficient to prevent cross-user object manipulation.

Attack Vector

Exploitation requires authenticated access at Instructor level or higher. The attacker sends a crafted request to the plugin AJAX endpoint that dispatches stm_lms_delete_cover(), supplying a file_id value corresponding to any attachment on the site. Repeating the request with incrementing IDs allows bulk deletion of media assets, including files owned by administrators or students. The attack vector is network-based and requires no user interaction.

No verified public exploit code is available. Refer to the Wordfence Vulnerability Report and the WordPress Changeset Analysis for the patch diff.

Detection Methods for CVE-2026-5060

Indicators of Compromise

Unexpected calls to the stm_lms_delete_cover AJAX action from Instructor accounts, particularly with sequential file_id values.
WordPress media library entries missing without a corresponding administrator action in the site audit log.
Broken image references across course pages, posts, or the media library that appear after Instructor account activity.
HTTP POST requests to admin-ajax.php or the plugin's REST route referencing stm_lms_delete_cover from non-owner sessions.

Detection Strategies

Enable WordPress action logging and alert on invocations of wp_delete_attachment() triggered by non-administrator roles.
Correlate deletion events with the acting user ID and the attachment's post_author field to flag mismatches.
Monitor web access logs for high-frequency requests to the plugin's AJAX endpoint containing incrementing file_id parameters.

Monitoring Recommendations

Deploy a WordPress activity or audit log plugin capturing attachment deletion events with user attribution.
Alert when a single authenticated user deletes more than a defined threshold of attachments in a short interval.
Review Instructor account sign-in patterns for anomalous IP addresses or automation signatures.

How to Mitigate CVE-2026-5060

Immediate Actions Required

Update the MasterStudy LMS WordPress Plugin to a version released after 3.7.14 that includes the fix referenced in the plugin changeset.
Audit the Instructor role membership and remove accounts that no longer require course-authoring privileges.
Back up the WordPress uploads directory and database before applying updates so any deleted attachments can be restored.
Review the media library and site content for missing attachments and restore from backups where required.

Patch Information

Stackable Themes released a patched build of the plugin. The remediation adds an ownership check on the file_id parameter before invoking wp_delete_attachment(). The commit is captured in the WordPress Changeset Analysis. Site operators should upgrade to the first release that supersedes version 3.7.14.

Workarounds

Temporarily restrict Instructor-level accounts to trusted staff only until the patched plugin version is deployed.
Use a Web Application Firewall (WAF) rule to block requests containing the stm_lms_delete_cover action from untrusted sources.
Disable the plugin on production sites where the LMS functionality is not actively required.

bash

# Example WAF rule (ModSecurity) to block the vulnerable AJAX action
SecRule ARGS:action "@streq stm_lms_delete_cover" \
    "id:1026506,phase:2,deny,status:403,\
    msg:'Block MasterStudy LMS stm_lms_delete_cover (CVE-2026-5060)'"