CVE-2026-88843: MasterStudy LMS Path Traversal Vulnerability

CVE-2026-88843 Overview

CVE-2026-88843 is a Local File Inclusion (LFI) vulnerability in the MasterStudy LMS WordPress plugin versions prior to 3.7.50. The plugin fails to validate one of its display-style settings before using the value to construct a template path. Authenticated users with Contributor role or above can abuse this flaw to include and execute arbitrary local PHP files on the server. The issue mirrors an earlier path traversal flaw [CWE-22] that was patched in a prior release, but this equivalent code path was overlooked and remains exploitable in versions the earlier advisory listed as fixed.

Critical Impact
Authenticated attackers with Contributor privileges can execute arbitrary PHP files already present on the server, enabling full compromise of the WordPress site.

Affected Products

MasterStudy LMS WordPress Plugin versions prior to 3.7.50
WordPress installations with the MasterStudy LMS plugin enabled
Sites that permit Contributor-level account registration or self-registration

Discovery Timeline

2026-09-24 - CVE CVE-2026-88843 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-88843

Vulnerability Analysis

The MasterStudy LMS plugin reads a display-style value from user-controllable input and passes it into template loading logic without sanitization. Because the value is concatenated into a filesystem path, an attacker can insert directory traversal sequences such as ../ to escape the intended templates directory. The resulting path is handed to a PHP file inclusion function, which parses and executes the referenced file as PHP code.

This is a classic Local File Inclusion flaw mapped to [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory). While the attacker cannot upload arbitrary files through this bug alone, inclusion of any .php file on the host executes its contents in the plugin context. Chained with log poisoning, session file writes, or uploaded media that contains PHP payloads, the primitive produces remote code execution.

An earlier MasterStudy LMS advisory addressed an equivalent sink. The maintainers patched one call site but missed the parallel code path now tracked as CVE-2026-88843, so sites administrators believed were remediated remain vulnerable.

Root Cause

The root cause is missing allow-list validation on a display-style parameter before it is used in template path construction. The plugin trusts the setting value and never confirms the resolved file resides within the expected template directory.

Attack Vector

Exploitation requires an authenticated account at Contributor level or higher. The attacker submits a request that sets the vulnerable display-style parameter to a traversal string pointing at a PHP file on disk. The server includes and executes that file. Technical specifics are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-88843

Indicators of Compromise

Web server access logs containing ../ sequences in parameters associated with MasterStudy LMS shortcodes or AJAX endpoints.
Unexpected PHP execution originating from the masterstudy-lms-learning-management-system plugin directory.
Creation of new administrator accounts or WordPress option changes shortly after Contributor-level logins.
Outbound connections from the web server to unfamiliar hosts following requests to LMS plugin endpoints.

Detection Strategies

Review HTTP request logs for display-style or template parameters that contain path separators, encoded traversal sequences such as %2e%2e%2f, or .php extensions.
Audit WordPress user registrations and role assignments for unexpected Contributor, Author, or Editor accounts.
Enable PHP open_basedir logging to surface file inclusions outside the WordPress document root.

Monitoring Recommendations

Alert on file reads from the plugin against paths outside its own directory tree.
Monitor the WordPress uploads directory for files with PHP content inside non-PHP extensions.
Correlate authentication events with subsequent requests to LMS plugin AJAX actions to identify abuse patterns.

How to Mitigate CVE-2026-88843

Immediate Actions Required

Upgrade the MasterStudy LMS plugin to version 3.7.50 or later on every affected WordPress site.
Audit all accounts with Contributor role or above and remove any that are not required.
Rotate credentials and WordPress salts if exploitation is suspected.
Review recently modified PHP files and uploads for webshells planted through LFI chaining.

Patch Information

The vendor fixed the vulnerability in MasterStudy LMS version 3.7.50. The patch adds validation on the display-style setting before it is used in template path construction. Refer to the WPScan Vulnerability Report for additional technical details and references.

Workarounds

Restrict account creation and remove the ability for untrusted users to hold Contributor or higher roles until patching is complete.
Place a web application firewall rule in front of WordPress to block requests containing traversal sequences targeting LMS plugin endpoints.
Set PHP open_basedir to confine inclusions to the WordPress installation directory, limiting the reach of LFI primitives.

bash

# Example php.ini hardening to constrain file inclusion scope
open_basedir = "/var/www/html/:/tmp/"
disable_functions = "system,exec,shell_exec,passthru,proc_open,popen"
allow_url_include = Off