CVE-2026-28145 MEDIUM

CVE-2026-28145: WordPress MasterStudy LMS plugin <= 3.7.39 - Broken Access Control vulnerability

Vendor Stylemixthemes

Product MasterStudy LMS

Weakness CWE-345

Published July 31, 2026

Last update July 31, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n/a through 3.7.39.

Explanation of Vulnerability in Simple Terms

02Summary

MasterStudy LMS versions up to 3.7.39 do not properly verify the authenticity of data, allowing an attacker to modify information without detection. The vulnerability requires no authentication or user interaction and can be exploited over the network. This affects the integrity of course content, user records, or other critical data stored in the LMS.

What an attacker can do

03Attacker Capabilities

Modify data in the LMS without proper verification, such as course content or user records.

Potential impact on your site

04Site Impact

Course content, grades, user data, or other LMS records could be altered by an attacker without your knowledge.

Conditions required to exploit

05Prerequisites

Network access to the LMS; no authentication or user interaction required.

Key dates

06Disclosure timeline

July 31, 2026 CVE published

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-28145 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/345.html AskarLabs — CWE-345 write-up Insufficient Verification of Data Authenticity

Related vulnerabilities

08Related CVE

CVE-2026-0939 Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.2 - Unauthenticated Order Status Manipulation CVE-2026-3177 Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook CVE-2025-14444 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment CVE-2024-1718 Claudio Sanches – Checkout Cielo for WooCommerce <= 1.1.0 - Insufficient Verification of Data Authenticity to Order Payment Status Update CVE-2024-2384 WooCommerce POS <= 1.4.11 - Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information Disclosure