CVE-2026-5060

CVE-2026-5060 is an IDOR vulnerability in the MasterStudy LMS WordPress plugin that allows any authenticated Instructor-level user to delete arbitrary site attachments, not just their own. The vulnerable function `stm_lms_delete_cover()` accepts a `file_id` parameter from the request and calls `wp_delete_attachment()` directly without verifying that the requesting user owns that attachment. The fix is a one-line ownership check: verify that the attachment's `post_author` matches the current user before deletion. The patched code should compare `get_post_field('post_author', $file_id)` against the current user's ID and abort if they don't match. This matters more than a typical IDOR because an LMS sits at the center of an educational data ecosystem. Course cover images, certificate templates, profile photos, grading artifacts, and submission records are all WordPress attachments. Deleting an attachment that a certificate or course completion record references doesn't just remove a file—it breaks downstream functionality that students and administrators depend on. The CVSS 6.5 score measures technical severity, not organizational blast radius. This pattern—attachment deletion without ownership validation—appears in WordPress plugins with striking regularity. Any plugin exposing a low-level WordPress primitive like `wp_delete_attachment()` through an AJAX or REST endpoint is a candidate for the same bug. When auditing WordPress plugins, treat any function that takes an ID from `$_POST` or `$_GET` and passes it to a core deletion function as a high-priority IDOR search space. The recurrence is predictable because the vulnerable pattern is structurally simple and the authorization check is easy to omit. For immediate action: verify your MasterStudy LMS installation is at version 3.7.14 or later. If you're running an older version, treat any Instructor-level account as having potentially already exploited this. Audit your attachment table for orphaned records from former instructors—attachments whose post_author no longer corresponds to an active user account represent a persistent (if low-priority) attack surface.

Reviewed through automated stages and approved by a human before publication.