Skip to content
fr Sign in
2.7 Low

CVE-2026-88844 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the…

Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.

Affected products and versions

Product Affected versions Fixed in
MasterStudy LMS WordPress Plugin 3.6 3.6.2 → < 3.7.50 3.7.50

References

Timeline

  1. Published
  2. Last modified

Other CVEs of MasterStudy LMS WordPress Plugin

The 20 CVEs of MasterStudy LMS WordPress Plugin →
CVE-2026-88849 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its… 2.7 Low CVE-2026-88845 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks… 4.3 Medium CVE-2026-88846 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled… 5.3 Medium CVE-2026-88843 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings… 7.2 High
Track this CVE