Low
2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user...
CVE-2026-88849
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| CVE | MasterStudy LMS WordPress Plugin |
≥ 3.7.13, < 3.7.55 |
3.7.55 |
Original description The description as published by the source.
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web contact@wpscan.com
- web nvd.nist.gov
- web wpscan.com
- web github.com