The MasterStudy LMS Pro plugin for WordPress allows authenticated users with Subscriber-level access or higher to upload arbitrary files because the 'install_and_activate_plugin' function does not validate the file type. This flaw is a file upload bypass (CWE-434) and can place any file on the server, enabling attackers to deposit code that may execute remotely if the upload directory is web‑executable. The vulnerability is not trivial; it requires correct timing and environmental conditions, yet the potential for serious compromise exists once the file is placed.

All StylemixThemes MasterStudy LMS Pro plugins for WordPress up to and including version 4.7.9 are affected. The flaw exists in the file upload handling bundled with these releases and therefore any site running one of these versions on WordPress is at risk.

The CVSS score of 7.5 indicates high severity, but the EPSS score of less than 1% shows that exploitation is considered unlikely based on current data. The vulnerability is not listed in CISA’s KEV catalog, meaning there is no public report of active exploitation. Attackers must first authenticate with at least Subscriber privileges, then upload a malicious file; environmental constraints such as timing make successful exploitation more challenging but not impossible.