CVE-2026-88849 — MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment

CVE-2026-88849

MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment PUBLISHED

Description (CNA)

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.

Affected (CNA)

Vendor / product	Versions
Unknown / MasterStudy LMS WordPress Plugin	affected 3.7.13 before 3.7.55

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/fa3df78f-d12f-4f10-8ed4-5e295123141b/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.