The MasterStudy LMS WordPress Plugin before 3.7.50 fails to validate a display‑style configuration used in the Elementor Courses Categories Widget. This oversight allows a user with Contributor or higher privileges to supply an arbitrary file path that is then used to build a template path, leading to inclusion and execution of any local PHP file on the server. The result is remote code execution bounded by the permissions of the contributor role, which can compromise the entire site and expose sensitive data.

WordPress sites running the MasterStudy LMS plugin version 3.5.29 and all earlier releases up to, but not including, 3.7.50 are affected. The vulnerability exploits the Elementor Courses Categories Widget within the plugin.

The CVSS score of 7.2 reflects a high severity of the Local File Inclusion, while the lack of an EPSS score and absence from the CISA KEV catalog suggest no widespread exploitation to date. The vulnerability remains exploitable as long as a contributor account exists. Attackers can trigger the Local File Inclusion remotely via the plugin’s interface, potentially executing arbitrary PHP on the server. The impact could extend to full site compromise, data exfiltration, or further lateral movement within the hosting environment.