CVE-2026-80067 MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter

What is CVE-2026-80067?

CVE-2026-80067 is a medium-severity vulnerability in Stylemix MasterStudy LMS WordPress Plugin, published on 29 Oct 2026.

Official description

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata.

Weakness: CWE-22

Which versions are affected by CVE-2026-80067?

How do I fix CVE-2026-80067?

No fix has been published for CVE-2026-80067 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-80067 being exploited?

There is no known exploitation of CVE-2026-80067 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w23g-3684-c4x8.