Auth bypass in Masterstudy Lms WordPress Plugin
CVE-2026-88844
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.
Vulnerability class: IDOR (Insecure Direct Object Reference)
CVSS v3 metric
CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Unknown Masterstudy Lms Wordpress Plugin
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-88844?
- CVE-2026-88844 is a low-severity vulnerability in Masterstudy Lms WordPress Plugin, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 2.7/10. Published 2026-09-18.
- How severe is CVE-2026-88844?
- Low severity. CVSS v3 base score is 2.7 out of 10.