CVE-2026-78284: MasterStudy LMS Path Traversal Vulnerability

CVE-2026-78284 Overview

CVE-2026-78284 is an unauthenticated arbitrary file deletion vulnerability affecting the MasterStudy LMS Learning Management System WordPress plugin in versions up to and including 3.7.42. The flaw is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and is exploitable remotely over the network without authentication or user interaction. Successful exploitation allows an attacker to delete files on the underlying server, which can crash the WordPress site or enable further compromise when critical files such as wp-config.php are removed.

Critical Impact
Unauthenticated remote attackers can delete arbitrary files on affected MasterStudy LMS installations, leading to site takeover or denial of service.

Affected Products

MasterStudy LMS Learning Management System WordPress plugin, versions <= 3.7.42
WordPress sites running the vulnerable plugin build
Any hosting environment exposing the affected plugin endpoint to the internet

Discovery Timeline

2026-08-24 - CVE-2026-78284 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78284

Vulnerability Analysis

The vulnerability is a path traversal flaw that leads to arbitrary file deletion. An attacker supplies a crafted file path to a vulnerable plugin endpoint, and the plugin resolves and deletes the target file without verifying that the path stays within an allowed directory. Because no authentication is required, any remote attacker who can reach the WordPress site can invoke the vulnerable functionality.

Deleting arbitrary files on a WordPress host has severe availability consequences. Removing wp-config.php forces WordPress into a fresh installation state, which attackers can then hijack to point the site to an attacker-controlled database. Deleting plugin, theme, or core PHP files breaks the site and can be used to disable security controls. The current EPSS score is 0.346% at the 27.244 percentile.

Root Cause

The root cause is missing or insufficient validation of a user-controlled file path parameter combined with missing authentication and capability checks on the handler. The plugin trusts the supplied path and passes it to a file deletion routine such as PHP's unlink() without canonicalizing the path or enforcing a directory allowlist. Traversal sequences like ../ reach files outside the intended plugin directory.

Attack Vector

Exploitation occurs over HTTP or HTTPS against the WordPress site. The attacker sends a crafted request to the vulnerable plugin action, supplying a relative path that traverses out of the plugin uploads directory to a sensitive target file. No credentials, session, or user interaction are required. Technical specifics are described in the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-78284

Indicators of Compromise

Unexpected absence of critical WordPress files such as wp-config.php, .htaccess, or plugin bootstrap files.
WordPress site suddenly redirecting to the installation wizard at /wp-admin/install.php.
Web server error logs showing PHP unlink() or file-not-found errors tied to MasterStudy LMS handlers.

Detection Strategies

Inspect access logs for POST or GET requests to MasterStudy LMS AJAX or REST endpoints containing ../ traversal sequences or absolute paths.
Alert on unauthenticated requests to plugin actions that reference file path parameters.
Baseline the WordPress installation with file integrity monitoring and flag deletions of core, plugin, or configuration files.

Monitoring Recommendations

Enable WordPress audit logging and forward events to a centralized SIEM for correlation with web server telemetry.
Monitor filesystem change events on the wp-content/plugins/masterstudy-lms-learning-management-system/ directory and site root.
Track outbound and inbound traffic patterns for reconnaissance scans targeting known WordPress plugin vulnerabilities.

How to Mitigate CVE-2026-78284

Immediate Actions Required

Update the MasterStudy LMS plugin to a version later than 3.7.42 as soon as the vendor releases a fixed build.
If a patched version is not yet available, deactivate and remove the plugin from production WordPress sites.
Restore any missing WordPress files from a known-good backup and rotate database and admin credentials if wp-config.php was exposed.

Patch Information

Refer to the Patchstack Vulnerability Report for the authoritative fixed-version guidance. Verify the installed plugin version in the WordPress admin under Plugins after updating.

Workarounds

Block requests containing path traversal sequences such as ../ in query strings and POST bodies at the web application firewall (WAF).
Restrict access to MasterStudy LMS AJAX and REST endpoints to authenticated users through server-level rules until a patch is applied.
Enforce least-privilege filesystem permissions so the PHP process cannot delete files outside the intended upload directories.

bash

# Example NGINX rule to block traversal attempts against the plugin path
location ~* /wp-content/plugins/masterstudy-lms-learning-management-system/ {
    if ($args ~* "\.\./") { return 403; }
    if ($request_uri ~* "\.\./") { return 403; }
}