CVE-2025-7438

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7438", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-10T17:37:03.103Z", "datePublished": "2025-07-18T06:45:33.113Z", "dateUpdated": "2026-04-08T16:38:08.249Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:38:08.249Z"}, "affected": [{"vendor": "StylemixThemes", "product": "MasterStudy LMS Pro", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.7.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'install_and_activate_plugin' function in all versions up to, and including, 4.7.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability is difficult to exploit due to timing requirements and environmental factors."}], "title": "MasterStudy LMS \u2013 Online Courses, eLearning PRO Plus <= 4.7.9 - Authenticated (Subscriber+) Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1ab970f5-35d1-43e9-891c-87a2a3e464c6?source=cve"}, {"url": "https://docs.stylemixthemes.com/masterstudy-lms/changelog-pro-version"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Th\u00e1i An"}], "timeline": [{"time": "2025-07-17T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-18T13:03:00.905390Z", "id": "CVE-2025-7438", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-18T13:03:14.604Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7438", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-18T13:03:00.905390Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-18T13:03:06.132Z"}}], "cna": {"title": "MasterStudy LMS \u2013 Online Courses, eLearning PRO Plus <= 4.7.9 - Authenticated (Subscriber+) Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Th\u00e1i An"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "StylemixThemes", "product": "MasterStudy LMS Pro", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.7.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-17T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1ab970f5-35d1-43e9-891c-87a2a3e464c6?source=cve"}, {"url": "https://docs.stylemixthemes.com/masterstudy-lms/changelog-pro-version"}], "descriptions": [{"lang": "en", "value": "The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'install_and_activate_plugin' function in all versions up to, and including, 4.7.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability is difficult to exploit due to timing requirements and environmental factors."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-07-18T06:45:33.113Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7438", "state": "PUBLISHED", "dateUpdated": "2025-07-18T13:03:14.604Z", "dateReserved": "2025-07-10T17:37:03.103Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-18T06:45:33.113Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MasterStudy LMS Pro", "vendor": "StylemixThemes", "versions": [{"lessThanOrEqual": "4.7.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'install_and_activate_plugin' function in all versions up to, and including, 4.7.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability is difficult to exploit due to timing requirements and environmental factors."}, {"lang": "es", "value": "El complemento MasterStudy LMS Pro para WordPress es vulnerable a la carga de archivos arbitrarios debido a una validaci\u00f3n insuficiente del tipo de archivo en la funci\u00f3n \"install_and_activate_plugin\" en todas las versiones hasta la 4.7.9 incluida. Esto permite que atacantes autenticados, con acceso de suscriptor o superior, carguen archivos arbitrarios en el servidor del sitio afectado, lo que podr\u00eda posibilitar la ejecuci\u00f3n remota de c\u00f3digo. Esta vulnerabilidad es dif\u00edcil de explotar debido a los requisitos de tiempo y a factores del entorno."}], "id": "CVE-2025-7438", "lastModified": "2026-06-17T10:04:57.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7438", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-07-18T13:03:00.905390Z", "version": "2.0.3"}}]}, "published": "2025-07-18T07:15:24.913", "references": [{"source": "security@wordfence.com", "url": "https://docs.stylemixthemes.com/masterstudy-lms/changelog-pro-version"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1ab970f5-35d1-43e9-891c-87a2a3e464c6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:39:29.508790+00:00", "value": {"mitigation_remediation": ["Upgrade MasterStudy LMS Pro to version 4.8.0 or newer to apply the vendor patch that implements type validation for uploads", "Restrict the ability for Subscriber and lower roles to perform plugin uploads or activations by adjusting WordPress role capabilities or using a role\u2011management plugin", "Configure the web server so that uploaded files are stored in a non\u2011executable directory and set PHP execution permissions to deny execution of arbitrary files"], "summary": {"action": "Patch Now", "impact": "Potential for remote code execution via authenticated file upload"}, "threat_synthesis": {"affected_systems": "All StylemixThemes MasterStudy LMS Pro plugins for WordPress up to and including version 4.7.9 are affected. The flaw exists in the file upload handling bundled with these releases and therefore any site running one of these versions on WordPress is at risk.", "description_and_impact": "The MasterStudy LMS Pro plugin for WordPress allows authenticated users with Subscriber-level access or higher to upload arbitrary files because the 'install_and_activate_plugin' function does not validate the file type. This flaw is a file upload bypass (CWE-434) and can place any file on the server, enabling attackers to deposit code that may execute remotely if the upload directory is web\u2011executable. The vulnerability is not trivial; it requires correct timing and environmental conditions, yet the potential for serious compromise exists once the file is placed.", "risk_and_exploitability": "The CVSS score of 7.5 indicates high severity, but the EPSS score of less than 1% shows that exploitation is considered unlikely based on current data. The vulnerability is not listed in CISA\u2019s KEV catalog, meaning there is no public report of active exploitation. Attackers must first authenticate with at least Subscriber privileges, then upload a malicious file; environmental constraints such as timing make successful exploitation more challenging but not impossible."}}}}, "created": "2026-04-22T14:45:19.292586+00:00", "updated": "2026-04-22T14:45:19.292598+00:00", "vendors": []}