CVE-2026-80069

MediumCVSS 5.4/10Last modified Nov 2, 2026

Description

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via cross-site request forgery to cause an uncaught PHP fatal error that, when display_errors is enabled, discloses the absolute filesystem path of the plugin.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Stylemix	MasterStudy LMS WordPress Plugin	< 3.7.50

References

Timeline

Published: Oct 29, 2026
Last modified: Nov 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-80077.5Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the CVE-2026-800717.2The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate th CVE-2026-800724.7The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirect CVE-2026-800736.5Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.CVE-2026-800748.8Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-800757.8Heap-based buffer overflow in Windows Work Folders allows an authorized attacker to elevate privileges locally.CVE-2026-800766.5Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.CVE-2026-800778.8Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-800786.5Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.CVE-2026-800796.5Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.CVE-2026-80085.4Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malic CVE-2026-800808.8Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.