All vulnerabilities
CVE-2026-88845

MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import

Unknown MasterStudy LMS WordPress PluginApplications & CMS
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.7.50Fixed versionCVE List
Published24 Sep 2026Updated 24 Sep 2026CVE List

What fixes it

  • 3.7.50MasterStudy LMS WordPress PluginCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account.

Text from CVE List

Affected versions 1

  • MasterStudy LMS WordPress Pluginaffected: 2.3.0 before 3.7.50CVE List

References 1