The MasterStudy LMS WordPress Plugin before 3.7.50 fails to validate a display-style configuration used in the Elementor Courses Categories Widget. This oversight allows a user with Contributor or higher privileges to supply an arbitrary file path that is then used to build a template path, leading to inclusion and execution of any local PHP file on the server. The result is remote code execution bounded by the permissions of the contributor role, which can compromise the entire site and expose sensitive data.

WordPress sites running the MasterStudy LMS plugin version 3.5.29 and all earlier releases up to, but not including, 3.7.50 are affected. The vulnerability exploits the Elementor Courses Categories Widget within the plugin.

The absence of a publicly available EPSS score and its lack of listing in the CISA KEV catalog suggest that large‑scale exploitation has not been observed to date, but the vulnerability remains exploitable as long as a contributor account exists. Attackers can trigger the Local File Inclusion remotely via the plugin’s interface, potentially executing arbitrary PHP on the server. The impact could extend to full site compromise, data exfiltration, or further lateral movement within the hosting environment.