The MasterStudy LMS Pro plugin for WordPress suffers from an unrestricted file upload vulnerability (CWE-434) in the stm_lms_add_assignment_attachment function. This occurs because the plugin fails to validate file types before accepting uploads, allowing authenticated users with low privileges (Subscriber and above) to upload arbitrary files. Such uploads may lead to remote code execution on the hosting server. The vulnerability affects all versions up to and including 4.7.0. No patch or official fix details are currently available, and no known exploits are reported in the wild.

An attacker with Subscriber-level access or higher can upload arbitrary files to the server hosting the vulnerable plugin. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The vulnerability has a high CVSS score (8.8), reflecting its potential for severe impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user permissions to trusted users only and consider disabling file uploads in the plugin if possible. Monitor for updates from StylemixThemes and apply patches promptly once available.