WordPress MasterStudy LMS Path Traversal to RCE

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-88843 is a path traversal vulnerability in the MasterStudy LMS WordPress plugin that allows authenticated users with Contributor role or higher to execute arbitrary PHP files on the server. By manipulating display-style settings without proper validation, attackers can craft malicious template paths that escape the intended directory and access sensitive files anywhere on the server filesystem. This vulnerability is particularly dangerous because it requires only mid-level WordPress permissions rather than administrative access, significantly expanding the threat surface for multi-user WordPress installations, educational platforms, and LMS deployments that rely on this popular plugin. The CVSS score of 7.2 reflects the high risk, and the fact that this represents a regression—an equivalent path was supposedly patched in earlier versions but this instance was overlooked—suggests a systematic validation gap that likely affects multiple code paths.

Casky's 351 mapped skills detect the attack chain behind this vulnerability by identifying behaviors across two critical MITRE ATT&CK tactics: Initial Access (TA0001) and Discovery (TA0007). Practitioners using Casky's extended reasoning would observe findings indicating suspicious parameter manipulation of WordPress plugin settings, particularly around template or path-related configurations. The platform's skills would flag attempts to include files outside expected directories, monitor for PHP execution in unexpected locations, and detect the reconnaissance pattern where attackers with Contributor access probe for file system structure. When correlated through Claude AI's reasoning engine, these signals would reveal the classic Local File Inclusion (LFI) to Remote Code Execution (RCE) progression—showing how an authenticated user systematically escalates their capabilities by discovering writable paths, testing path traversal payloads, and ultimately achieving code execution without requiring plugin or WordPress updates.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-88843.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-88843

Casky has 351 skills that investigate the attack patterns behind CVE-2026-88843. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn