4.3
Medium
CVE-2026-88847 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course…
Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MasterStudy LMS WordPress Plugin 3.7 | earliest → < 3.7.50 | 3.7.50 |
References
- wpscan.com wpscan.com
Timeline
- Published
- Last modified
Other CVEs of MasterStudy LMS WordPress Plugin
The 20 CVEs of MasterStudy LMS WordPress Plugin →
CVE-2026-88849
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its…
2.7
Low
CVE-2026-88846
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled…
5.3
Medium
CVE-2026-88845
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks…
4.3
Medium
CVE-2026-88843
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings…
7.2
High