CVE-2026-88848
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold. This allows any member to enrol themselves into restricted paid courses outside their plan and beyond the number of courses it entitles them to.
Risk Assessment
The organization may suffer financial losses because users gain access to paid content without the appropriate membership plan. This can also undermine the business model and access control for courses.
Recommendation
Update the MasterStudy LMS plugin to version 3.7.50 or later. Additionally, verify that the plugin correctly checks course plan coverage and member entitlements.
Other vulnerabilities in MasterStudy LMS WordPress plugin
See all- CVE-2026-88846Medium
The MasterStudy LMS WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled.
- CVE-2026-88845Medium
The MasterStudy LMS WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account.
- CVE-2026-88843High
The MasterStudy LMS WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release but this one was not, so the issue persists in versions the earlier advisory reports as fixed.
- CVE-2026-81340Low
The MasterStudy LMS WordPress Plugin before version 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.
- CVE-2026-81195Medium
The MasterStudy LMS WordPress plugin before version 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data. This allows unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user.
- CVE-2026-81194Medium
The MasterStudy LMS WordPress plugin before version 3.7.46 does not properly verify authorization when retrieving order line-item data. This allows any authenticated user, including Subscribers, to read other instructors' course sales records by supplying another user's identifier.
Original NVD description (English source)
The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid courses outside their plan and beyond the number of courses it entitles them to.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS