CVE-2025-7438 is a high-severity vulnerability (CVSS 7.5) in the MasterStudy LMS Pro plugin for WordPress. It involves CWE-434: Unrestricted Upload of File with Dangerous Type. The vulnerability arises from inadequate validation of file types in the 'install_and_activate_plugin' function, allowing authenticated users with low privileges (Subscriber-level and above) to upload arbitrary files to the server. This could enable remote code execution under certain conditions, although exploitation is noted to be difficult due to timing and environmental factors. There is no indication of known exploits in the wild or available patches at this time.

Successful exploitation could allow an authenticated low-privilege user to upload arbitrary files, potentially leading to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The difficulty of exploitation reduces immediate risk, but the impact remains high if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user permissions to trusted users only and monitor for suspicious activity related to file uploads. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from StylemixThemes for patches or official mitigations.