What the vulnerability does
01Description
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability checks on multiple REST API endpoints in all versions up to, and including, 3.7.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload or delete arbitrary media files, delete or modify posts, and create/manage course templates
Explanation of Vulnerability in Simple Terms
02Summary
The MasterStudy LMS WordPress plugin through version 3.7.6 lacks proper authorization checks on certain functions. A logged-in user with low privileges can read and modify data they should not have access to, such as other users' course information or settings. The vulnerability requires an active WordPress account but no special permissions.
What an attacker can do
03Attacker Capabilities
Read and modify course data and settings belonging to other users.
Potential impact on your site
04Site Impact
Student or subscriber accounts can access and alter course content, enrollments, or settings of other users without authorization.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., student or subscriber role).
Key dates
06Disclosure timeline
January 6, 2026
CVE published
April 8, 2026
Record updated
