CVE-2026-5060: 
WordPress vulnerability analysis and mitigation

CVE-2026-5060 is an Insecure Direct Object Reference (IDOR) vulnerability in the MasterStudy LMS WordPress Plugin – for Online Courses and Education, developed by StyleMix. It affects all versions up to and including 3.7.14, allowing authenticated attackers with Instructor-level access or above to delete arbitrary file attachments belonging to any user. The vulnerability was published on July 29, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Wordfence).

The root cause is an authorization bypass through a user-controlled key (CWE-639) in the stm_lms_delete_cover() function located in _core/lms/classes/user.php. The function accepts a file_id parameter and passes it directly to WordPress's wp_delete_attachment() without verifying that the requesting user owns the referenced attachment. Because WordPress attachment IDs are sequential integers, an authenticated Instructor can enumerate IDs and issue deletion requests for attachments belonging to other users. The vulnerable code paths are visible at lines 2093 and 2107 of the affected source file (GitHub Advisory, WordPress Trac).

Successful exploitation allows an authenticated attacker with at minimum Instructor-level privileges to permanently delete any media attachment on the WordPress site, regardless of ownership. This results in a high integrity impact — course materials, user profile images, documents, and other uploaded content belonging to students, administrators, or other instructors can be irreversibly destroyed. There is no confidentiality or availability impact beyond the data loss caused by unauthorized deletion (GitHub Advisory, Wordfence).

1. Obtain Instructor-level access: Register or compromise an account with Instructor-level privileges on a WordPress site running MasterStudy LMS ≤ 3.7.14.
2. Identify the vulnerable endpoint: Locate the AJAX action or REST endpoint that invokes stm_lms_delete_cover(), typically triggered when an instructor removes a course cover image.
3. Enumerate attachment IDs: WordPress attachment IDs are sequential integers. Begin with a known or guessed ID (e.g., start from 1 or a recently observed ID) and increment to discover valid attachment IDs belonging to other users.
4. Craft malicious deletion requests: Send authenticated HTTP requests to the deletion endpoint with arbitrary file_id values corresponding to attachments owned by other users (e.g., students or administrators).
5. Achieve unauthorized deletion: Because no ownership check is performed, wp_delete_attachment() executes and permanently removes the targeted attachment from the WordPress media library (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing repeated POST requests to the stm_lms_delete_cover AJAX action (admin-ajax.php?action=stm_lms_delete_cover) with sequentially incrementing file_id values from a single authenticated session.
• Logs: WordPress debug or audit logs recording multiple wp_delete_attachment() calls in rapid succession from an Instructor-level user account.
• File System: Unexpected disappearance of media files from wp-content/uploads/ directories, particularly files not associated with the acting instructor's own courses or profile.
• Database: WordPress wp_posts table showing bulk deletion of records with post_type = 'attachment' attributed to an Instructor user in a short time window.

Administrators should update the MasterStudy LMS plugin to a version newer than 3.7.14 (the patch was committed in changeset 3501788 to trunk). The fix adds ownership validation to the stm_lms_delete_cover() function to ensure users can only delete attachments they own. As a temporary workaround, consider restricting Instructor-level account registration to trusted users, or using a WordPress firewall plugin (e.g., Wordfence) to block unauthorized requests to the deletion endpoint. Audit existing instructor accounts for suspicious activity (WordPress Trac Changeset, Wordfence).