All vulnerabilities
CVE-2026-88847

MasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation

Unknown MasterStudy LMS WordPress PluginApplications & CMS
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.7.50Fixed versionCVE List
Published24 Sep 2026Updated 24 Sep 2026CVE List

What fixes it

  • 3.7.50MasterStudy LMS WordPress PluginCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to.

Text from CVE List

Affected versions 1

  • MasterStudy LMS WordPress Pluginaffected: all versions before 3.7.50CVE List

References 1