CVE-2026-78284

WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.

We have discovered 1,541 live websites that are affected by CVE-2026-78284.

Run a Free Instant Scan



Affected Software

Product  Masterstudy LMS Learning Management System
Category Wordpress Plugins
Vulnerable Domains1,541 live websites (100% of Masterstudy LMS Learning Management System install base)
Vulnerable Versions
  • from 0 through 3.7.42
Vulnerable Versions Count125 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')



Details

  • Published - Aug 24, 2026
  • Updated - Aug 25, 2026

Credits

  • 20kilograma | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2026-78284
United States404 websites


Germany116 websites
France87 websites
GB83 websites
Italy78 websites
Spain69 websites
Cyprus62 websites
India58 websites
Brazil42 websites
Turkey29 websites

Website Distribution by TLD

Number of websites using CVE-2026-78284
.com663 websites
.org127 websites
.it51 websites
.net39 websites
.com.br36 websites
.es31 websites
.de30 websites
.co.uk29 websites
.pl22 websites
.nl21 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-78284

Top websites that are affected by CVE-2026-78284. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.org United States**,***
**************.***.br Brazil***,***
***********.**.za South Africa***,***
***********.***.co Colombia***,***
******************.com United States***,***
*****.org United States***,***
*****.**************.com United States***,***
****.***.au Australia***,***
*************.com United States***,***
********.*******.***.cl Chile***,***
See full domain list

FAQ

CVE-2026-78284 is Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Masterstudy LMS Learning Management System
A total of 1,541 websites have been identified as vulnerable to CVE-2026-78284, based on global website indexing conducted by WebTechSurvey.
The Masterstudy LMS Learning Management System is affected by the CVE-2026-78284 vulnerability.
Masterstudy LMS Learning Management System versions up to and including 3.7.42 are vulnerable to CVE-2026-78284.