A Severe Vulnerability in MasterStudy LMS Pro Exposes 1,000's of Sites

If your WordPress website uses MasterStudy LMS Pro, there’s a critical update you need to know about. Wordfence recently disclosed a severe vulnerability in the plugin that could allow attackers to upload malicious files and take full control of your site.

With over 15,000 active installs, this vulnerability puts thousands of educational websites at serious risk.

What Is MasterStudy LMS Pro?

MasterStudy LMS Pro is a premium WordPress plugin designed for creating and managing online learning platforms. It enables course creation, student management, quizzes, and payment integrations—all within the WordPress environment.

Its powerful features make it popular among educators and training providers, but the very complexity that gives it flexibility also expands its attack surface.

The Vulnerability at a Glance

How It Works

The vulnerability allows an attacker with subscriber-level access—or in some cases, no authentication at all—to upload arbitrary files, including executable PHP scripts. Once uploaded, these scripts can be executed remotely, giving the attacker full access to your site’s files and database.

This type of flaw is particularly dangerous because it bypasses typical safeguards and directly compromises the server’s file system.

According to the Wordfence Threat Intelligence team, the vulnerability stems from a missing file type and permission check in the assignment upload functionality. The affected endpoint didn’t properly restrict the file type or validate the user’s role, meaning that malicious users could exploit it with ease.

Who Is Affected?

Any WordPress website running an unpatched version of MasterStudy LMS Pro is vulnerable.

The plugin is commonly used by:

If you're unsure whether you're affected, check your plugin version and compare it to the latest release from the plugin's developers.

What You Should Do

Has This Been Exploited in the Wild?

As of publication, there have been no confirmed widespread attacks, but given the critical nature of the vulnerability and the low barrier to exploitation, attackers are likely to begin scanning for affected sites.

This is a case where proactive security can prevent a catastrophic breach.

Developer Response

The plugin developers responded promptly once the vulnerability was reported, issuing a patch and coordinating with security platforms to notify users. However, because MasterStudy LMS Pro is a premium plugin, some site owners may not receive automatic update notifications.

Ensure your license is active so you can access updates and be notified about future issues.

Final Thoughts

Security isn't just about reacting to threats—it's about staying ahead of them. This vulnerability serves as a reminder that even trusted plugins can introduce severe risks. As WordPress users, it’s our responsibility to stay informed and vigilant.

Make sure your website is updated, monitored, and backed up. If your site uses MasterStudy LMS Pro, take this seriously and act now.

WordPress Plugin Vulnerabilities (May 26 – June 2, 2025)

1. TI WooCommerce Wishlist

2. MasterStudy LMS Pro

3. Royal Elementor Addons and Templates

4. LA-Studio Element Kit for Elementor