CVE-2026-88849Low· 2.7▾ SunlitThe MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 14.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
— → 2.7
none → low
0.1%
0.1% → 0.2%
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.
masterstudy_lms_wordpress_plugin >= 3.7.13 < 3.7.55Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-80067Medium· 5.4MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter
CVE-2026-80069Medium· 4.3MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax
CVE-2026-88845Medium· 4.3The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create…
CVE-2026-88846Medium· 5.3The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated use…
CVE-2026-88847Medium· 4.3The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create cou…
CVE-2026-88843High· 7.2The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute …