[ CVE-2026-88849 · Published 22 Oct 2026 ]
Vulnerability in Unknown MasterStudy LMS WordPress Plugin
CVSS 2.7
EPSS <1%No fix listed yet
[ Description ]Official description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.