Incorrect authorization in MasterStudy LMS lets instructors rename users
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-863.
Summary
The MasterStudy LMS WordPress Plugin from 3.7.13 before 3.7.55 does not verify that a user targeted through its student enrollment feature is related to the requesting instructor. An authenticated user with the Instructor role (CWE-863) can overwrite the first name, last name and public display name of any registered user, including administrators, which enables impersonation and phishing. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | MasterStudy LMS WordPress Plugin | 3.7.13 to before 3.7.55 | 3.7.55 | Patch available | CNA |
- MasterStudy LMS WordPress Plugin VendorUnknown Affected 3.7.13 to before 3.7.55 Fixed in 3.7.55 Patch available CNA
Remediation
Update the MasterStudy LMS WordPress Plugin to version 3.7.55 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA MasterStudy LMS WordPress Plugin (Unknown) Fixed in 3.7.55
Timeline
- 2026-10-22 Threatist record created from CVE-2026-88849
- 2026-10-22 Alias added: GHSA-x2jm-76mq-q2pc
- 2026-10-22 CVSS score added · CISA ADP
- 2026-10-22 Weakness changed · CISA ADP
- 2026-10-22 CISA SSVC decision points changed
References
Sources
- CVE-2026-88849 · CVE Program
- CVE-2026-88849 · NVD
- FIRST EPSS
- GHSA-x2jm-76mq-q2pc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences