WordPress Plugin Vulnerabilities

MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment

Description

The plugin does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.

Proof of Concept

Affects Plugins

Plugin icon
masterstudy-lms-learning-management-system
Fixed in 3.7.55

References

CVE
CVE-2026-88849

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Arman Kumar
Submitter
Arman Kumar
Verified
Yes
WPVDB ID
fa3df78f-d12f-4f10-8ed4-5e295123141b

Timeline

Publicly Published
2026-10-20 (about 2 days ago)
Added
2026-10-20 (about 1 day ago)
Last Updated
2026-10-20 (about 1 day ago)

Other

Published
Title
Published
2026-07-22
Title
Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint
Published
2021-10-04
Title
Logo Slider and Showcase < 1.3.37 - Editor Plugin's Settings Update
Published
2026-09-02
Title
WPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in Forms
Published
2024-05-09
Title
LearnPress – WordPress LMS Plugin < 4.2.6.6 - Unauthenticated Bypass to User Registration
Published
2024-07-16
Title
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin < 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload