The MasterStudy LMS WordPress Plugin is vulnerable to an insecure direct object reference that lets an authenticated user with Instructor level or higher permissions delete any attachment by supplying an arbitrary file identifier. The flaw resides in the stm_lms_delete_cover() function, which does not verify that the requester owns the attachment before calling wp_delete_attachment(). An attacker can therefore enumerate successive attachment IDs and remove content belonging to other users, potentially deleting course materials or user uploads, leading to loss of valuable data.

Affected systems are installations of the MasterStudy LMS WordPress Plugin – for Online Courses and Education from stylemix, all versions up to and including 3.7.14. Login credentials for users with Instructor permissions or higher are sufficient for exploitability; the plugin itself is used within the WordPress administration interface.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score of less than 1% shows a low probability of exploitation in the wild, and the vulnerability is not listed in CISA KEV, reducing its prominence. An attacker requires only authenticated access with Instructor-level privileges; therefore the attack vector is likely local to the administrative interface, though the damage is destructive. The explicit lack of ownership checks in the deletion endpoint directly maps to CWE-639, representing insufficient authorization checks.