CVE-2026-88846

The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold. This allows any member to enrol themselves into restricted paid courses outside their plan and beyond the number of courses it entitles them to.

The MasterStudy LMS WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account.

The MasterStudy LMS WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release but this one was not, so the issue persists in versions the earlier advisory reports as fixed.

The MasterStudy LMS WordPress Plugin before version 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.

The MasterStudy LMS WordPress plugin before version 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data. This allows unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user.

The MasterStudy LMS WordPress plugin before version 3.7.46 does not properly verify authorization when retrieving order line-item data. This allows any authenticated user, including Subscribers, to read other instructors' course sales records by supplying another user's identifier.