CVE-2026-88845 — MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import

CVE-2026-88845

MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import PUBLISHED

Description (CNA)

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account.

Affected (CNA)

Vendor / product	Versions
Unknown / MasterStudy LMS WordPress Plugin	affected 2.3.0 before 3.7.50

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a1693fd3-7ba9-4a59-99ea-7f9fd00a9de1/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.