The MasterStudy LMS Pro plugin for WordPress contains a missing file type validation in the assignment attachment upload handler, enabling authenticated users with Subscriber-level access or higher to upload arbitrary files to the site’s server. This flaw allows an attacker to place executable code such as PHP, which could lead to full remote code execution on the underlying web server. The vulnerability is a classic instance of unchecked input leading to arbitrary file upload (CWE‑434).

All installations of StylemixThemes MasterStudy LMS Pro up to and including version 4.7.0 are affected. Users running WordPress with this plugin and having any role of Subscriber or higher are vulnerable; the security impact is limited to sites that have the plugin installed and have not applied the patch for 4.7.0 or later.

With a CVSS score of 8.8, the vulnerability is considered high severity. The EPSS score of 2% indicates moderate likelihood of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Attackers need authenticated access, which can be obtained via legitimate credentials, phishing, or compromised accounts. Given the potential for remote code execution and the lack of mitigation in the affected plugin, the risk to affected environments is substantial.