Description

Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T15:17:08.600Z",
  "pubdate": "2026-08-18T15:17:08.600Z",
  "executiveSummary": "An unauthenticated arbitrary file upload vulnerability exists in Masteriyo - LMS versions 2.3.2 and below. This security flaw allows remote, unauthenticated threat actors to upload arbitrary files to the underlying web server hosting the vulnerable application. The primary impact of this vulnerability is potential remote code execution (RCE), which could lead to full system compromise, data exfiltration, or unauthorized modification of web application assets. The affected systems include any WordPress installations utilizing the Masteriyo - LMS plugin within the vulnerable version range. The risk implications are severe due to the lack of authentication requirements, meaning any external attacker can interact directly with the vulnerable endpoint without prior credentials or session tokens. Exploitation requirements are minimal, primarily revolving around network access to the target web application and the ability to send specially crafted HTTP POST requests to the insecure upload handler. Successful exploitation grants the attacker the capability to deposit malicious scripts, such as web shells, directly into accessible directories of the web root, completely bypassing access controls and security perimeters established by the content management system.",
  "technicalDetails": "The root cause of this vulnerability stems from insufficient input validation, improper sanitization of user-supplied file names, and a lack of stringent type-checking mechanisms within the file upload handling routines of Masteriyo - LMS. The vulnerable component fails to adequately restrict file extensions, MIME types, or destination directories during the ingestion phase of multipart HTTP requests. Because the endpoint lacks authentication requirements and privilege checks, network exposure is direct and unhindered via standard HTTP/HTTPS protocols.\nThe attack flow begins when an unauthenticated attacker crafts a malicious HTTP POST request containing a payload, typically a polymorphic file or a script disguised as an allowable format, targeting the vulnerable upload functionality within the Masteriyo - LMS plugin. Upon receipt of the request, the flawed file handling logic processes the input without performing robust validation against executable file types such as PHP, or fails to store the uploaded artifact in a non-executable, sandboxed directory. Consequently, the payload is written directly to the target file system within a web-accessible directory.\nPost-exploitation impact is catastrophic. Once the arbitrary file is successfully uploaded, the attacker can directly access the file path via a standard web browser or automated HTTP request. This triggers execution of the embedded script within the context of the web server process. Depending on the privileges of the web server user, the attacker can achieve remote code execution, read sensitive configuration files containing database credentials, inject malicious database content, pivot to internal network segments, or deploy persistent backdoors for continuous access to the compromised hosting environment. The absence of authentication and privilege prerequisites drastically lowers the complexity of the attack vector, making automated exploitation via script trivial for malicious actors scanning for vulnerable Masteriyo - LMS deployments."
}