CVE-2026-88843
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The MasterStudy LMS WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release but this one was not, so the issue persists in versions the earlier advisory reports as fixed.
Risk Assessment
An authenticated low-privileged user can execute arbitrary PHP code on the server, leading to full site compromise. This includes data theft, content tampering, and further privilege escalation.
Recommendation
Update the MasterStudy LMS plugin to version 3.7.50 or later. Verify that earlier fixes were actually applied and restrict Contributor roles where not required.
Other vulnerabilities in MasterStudy LMS WordPress Plugin
See all- CVE-2026-88848Medium
The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold. This allows any member to enrol themselves into restricted paid courses outside their plan and beyond the number of courses it entitles them to.
- CVE-2026-88846Medium
The MasterStudy LMS WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled.
- CVE-2026-88845Medium
The MasterStudy LMS WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account.
- CVE-2026-81340Low
The MasterStudy LMS WordPress Plugin before version 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.
- CVE-2026-81195Medium
The MasterStudy LMS WordPress plugin before version 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data. This allows unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user.
- CVE-2026-81194Medium
The MasterStudy LMS WordPress plugin before version 3.7.46 does not properly verify authorization when retrieving order line-item data. This allows any authenticated user, including Subscribers, to read other instructors' course sales records by supplying another user's identifier.
Original NVD description (English source)
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS