{"id":48394,"date":"2025-06-03T08:01:44","date_gmt":"2025-06-03T08:01:44","guid":{"rendered":""},"modified":"2025-08-31T18:38:08","modified_gmt":"2025-09-01T00:38:08","slug":"cve-2025-4800-arbitrary-file-upload-vulnerability-in-masterstudy-lms-pro-plugin-for-wordpress","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-4800-arbitrary-file-upload-vulnerability-in-masterstudy-lms-pro-plugin-for-wordpress\/","title":{"rendered":"CVE-2025-4800: Arbitrary File Upload Vulnerability in MasterStudy LMS Pro Plugin for WordPress<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The cybersecurity landscape is riddled with vulnerabilities that can pose serious threats to systems and data. One such vulnerability, identified as CVE-2025-4800, resides in the MasterStudy LMS Pro plugin for WordPress. This widely used plugin is susceptible to arbitrary file uploads<\/a> due to a lack of file type validation in the stm_lms_add_assignment_attachment function. This vulnerability is particularly concerning due to the potential<\/a> for remote code execution, which could compromise systems and lead to data leakage.
\nWordPress plugins<\/a>, like MasterStudy LMS Pro, are commonly used to add functionality to websites. However, they can also introduce vulnerabilities that attackers can exploit<\/a>. The impact of such attacks can be severe, especially when they involve popular plugins used by a large number of websites.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-4800
\nSeverity: High (CVSS 8.8)
\nAttack Vector: Network
\nPrivileges Required: Low (Subscriber-level access)
\nUser Interaction: Required
\nImpact: Potential system compromise<\/a> and data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

MasterStudy LMS Pro<\/a> for WordPress | Up to and including 4.7.0<\/p>\n

How the Exploit Works<\/strong><\/p>\n

An attacker with Subscriber-level access could exploit this vulnerability by uploading an arbitrary file<\/a> to the server using the stm_lms_add_assignment_attachment function. This function lacks sufficient file type validation, allowing for the upload of files that could permit remote code execution<\/a>. With this capability, an attacker could potentially gain unauthorized access<\/a> to the system, modify system configurations, or download sensitive data.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

The following pseudocode illustrates the potential exploitation of this vulnerability<\/a>. In this example, a malicious user uploads a PHP shell script, which could allow for remote code execution<\/a>.<\/p>\n

POST \/wp-content\/plugins\/masterstudy-lms-learning-management-system-pro\/stm-lms-templates\/assignments\/add_file.php HTTP\/1.1\nHost: target.example.com\nContent-Type: multipart\/form-data; boundary=------------------------d74496d66958873e\n--------------------------d74496d66958873e\nContent-Disposition: form-data; name=\"file\"; filename=\"shell.php\"\nContent-Type: application\/x-php\n\n--------------------------d74496d66958873e--<\/code><\/pre>\n
In this conceptual example, the attacker uploads a PHP file<\/a> named “shell.php” that accepts a “cmd” URL parameter for executing system commands. Once the file is uploaded<\/a> and executed, the attacker could potentially perform any command on the system that the web server has privileges to execute.<\/p>\n
Mitigation Guidance<\/strong><\/p>\n
To mitigate this vulnerability, users of the affected plugin<\/a> should apply the patch provided by the vendor as soon as possible. In the interim, employing a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can serve as temporary mitigation measures. These tools can help to detect and block attempts to exploit this vulnerability<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The cybersecurity landscape is riddled with vulnerabilities that can pose serious threats to systems and data. One such vulnerability, identified as CVE-2025-4800, resides in the MasterStudy LMS Pro plugin for WordPress. This widely used plugin is susceptible to arbitrary file uploads due to a lack of file type validation in the stm_lms_add_assignment_attachment function. This […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[80],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-48394","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-rce"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t