Vulnerabilities and security researches formasterstudy-lms-learning-management-system masterstudy-lms-learning-management-system

Direction: ascending

Jun 07, 2024

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2022-0441

CVE, Research URL: CVE-2022-0441
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Mar 07, 2022
Research Description: The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin
Affected versions: max 2.7.6.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2023-35090

CVE, Research URL: CVE-2023-35090
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Jun 22, 2023
Research Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.7 versions.
Affected versions: max 3.0.9.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2024-1512

CVE, Research URL: CVE-2024-1512
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Feb 17, 2024
Research Description: The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected versions: max 3.2.6.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2024-3136

CVE, Research URL: CVE-2024-3136
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Apr 10, 2024
Research Description: The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Affected versions: max 3.3.4.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2023-35093

CVE, Research URL: CVE-2023-35093
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Jun 22, 2023
Research Description: Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any logged-in users, such as subscribers to view the "Orders" of the plugin and get the data related to the order like email, username, and more.
Affected versions: max 3.0.9.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2023-4278

CVE, Research URL: CVE-2023-4278
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Sep 12, 2023
Research Description: The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.
Affected versions: max 3.0.18.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2024-2106

CVE, Research URL: CVE-2024-2106
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Mar 13, 2024
Research Description: The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 3.2.10. This can allow unauthenticated attackers to extract sensitive data including all registered user's username and email addresses which can be used to help perform future attacks.
Affected versions: max 3.2.11.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2024-2411

CVE, Research URL: CVE-2024-2411
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Mar 29, 2024
Research Description: The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Affected versions: max 3.3.1.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2024-2409

CVE, Research URL: CVE-2024-2409
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Mar 29, 2024
Research Description: The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the _register_user() function called by the 'wp_ajax_nopriv_stm_lms_register' AJAX action. This makes it possible for unauthenticated attackers to register a user with administrator-level privileges when MasterStudy LMS Pro is installed and the LMS Forms Editor add-on is enabled.
Affected versions: max 3.3.2.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2024-3942

CVE, Research URL: CVE-2024-3942
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: May 02, 2024
Research Description: The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on several functions in versions up to, and including, 3.3.8. This makes it possible for authenticated attackers, with subscriber level permissions and above, to read and modify content such as course questions, post titles, and taxonomies.
Affected versions: max 3.3.9.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2024-1904

CVE, Research URL: CVE-2024-1904
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Apr 10, 2024
Research Description: The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the search_posts function in all versions up to, and including, 3.2.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose draft post titles and excerpts.
Affected versions: max 3.3.0.
Status: vulnerable

Jun 24, 2024

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2024-37093

CVE, Research URL: CVE-2024-37093
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Jan 02, 2025
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Cross Site Request Forgery.This issue affects MasterStudy LMS: from n/a through <= 3.2.1.
Affected versions: max 3.2.2.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2024-37094

CVE, Research URL: CVE-2024-37094
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Nov 01, 2024
Research Description: Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MasterStudy LMS: from n/a through 3.2.12.
Affected versions: max 3.2.13.
Status: vulnerable

Apr 05, 2025

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2025-32141

CVE, Research URL: CVE-2025-32141
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Apr 04, 2025
Research Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows PHP Local File Inclusion.This issue affects MasterStudy LMS: from n/a through <= 3.5.28.
Affected versions: max 3.5.29.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2025-32237

CVE, Research URL: CVE-2025-32237
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Apr 04, 2025
Research Description: Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.5.28.
Affected versions: max 3.5.29.
Status: vulnerable

May 06, 2025

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2024-5973

CVE, Research URL: CVE-2024-5973
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Jul 22, 2024
Research Description: The MasterStudy LMS WordPress Plugin WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which could be used to get access to functionalities they shouldn't have.
Affected versions: max 3.3.24.
Status: vulnerable

Sep 06, 2025

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2025-54744

CVE, Research URL: CVE-2025-54744
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Sep 05, 2025
Research Description: Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.6.15.
Affected versions: max 3.6.16.
Status: vulnerable

Nov 11, 2025

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2025-64366

CVE, Research URL: CVE-2025-64366
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Oct 31, 2025
Research Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through <= 3.6.27.
Affected versions: max 3.6.28.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2025-59575

CVE, Research URL: CVE-2025-59575
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Oct 22, 2025
Research Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
Affected versions: max 3.6.21.
Status: vulnerable

Jan 11, 2026

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2025-13766

CVE, Research URL: CVE-2025-13766
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Jan 06, 2026
Research Description: The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability checks on multiple REST API endpoints in all versions up to, and including, 3.7.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload or delete arbitrary media files, delete or modify posts, and create/manage course templates
Affected versions: max 3.7.7.
Status: vulnerable

Apr 14, 2026

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2026-0559

CVE, Research URL: CVE-2026-0559
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Feb 14, 2026
Research Description: The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_lms_courses_grid_display' shortcode in all versions up to, and including, 3.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 3.7.12.
Status: vulnerable

Apr 24, 2026

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2025-59577

CVE, Research URL: CVE-2025-59577
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Sep 23, 2025
Research Description: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Leveraging Race Conditions.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
Affected versions: max 3.6.21.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2025-59576

CVE, Research URL: CVE-2025-59576
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Sep 23, 2025
Research Description: Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
Affected versions: max 3.6.21.
Status: vulnerable

May 01, 2026

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2026-40766

CVE, Research URL: CVE-2026-40766
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Jun 16, 2026
Research Description: Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.
Affected versions: max 3.7.26.
Status: vulnerable

May 28, 2026

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2026-42730

CVE, Research URL: CVE-2026-42730
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: May 27, 2026
Research Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through <= 3.7.29.
Affected versions: max 3.7.30.
Status: vulnerable

Jun 13, 2026

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2023-33999

CVE, Research URL: CVE-2023-33999
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Jun 11, 2026
Research Description: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS. This issue affects WP Mail Log: from n/a through 1.0.2.
Affected versions: max 2.8.0.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2026-4817

CVE, Research URL: CVE-2026-4817
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Apr 17, 2026
Research Description: The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to Time-based Blind SQL Injection via the 'order' and 'orderby' parameters in the /lms/stm-lms/order/items REST API endpoint in versions up to and including 3.7.25. This is due to insufficient input sanitization combined with a design flaw in the custom Query builder class that allows unquoted SQL injection in ORDER BY clauses. When the Query builder detects parentheses in the sort_by parameter, it treats the value as a SQL function and directly concatenates it into the ORDER BY clause without any quoting. While esc_sql() is applied to escape quotes and backslashes, this cannot prevent ORDER BY injection when the values themselves are not wrapped in quotes in the resulting SQL statement. This makes it possible for authenticated attackers, with subscriber-level access and above, to append arbitrary SQL queries via the ORDER BY clause to extract sensitive information from the database including user credentials, session tokens, and other confidential data through time-based blind SQL injection techniques.
Affected versions: max 3.7.26.
Status: vulnerable

Jun 16, 2026

MasterStudy LMS WordPress Plugin – for Online Courses and Education # f43455118aba6c7f086e83f8998f7de9f947fd1a

CVE, Research URL: f43455118aba6c7f086e83f8998f7de9f947fd1a
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Feb 28, 2022
Research Description: MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system] < 2.8.0 WordPress MasterStudy LMS plugin < 2.8.0 - Sensitive Information Disclosure vulnerability Sensitive Information Disclosure vulnerability discovered in WordPress MasterStudy LMS plugin (versions < 2.8.0).
Affected versions: max 2.8.0.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # c1205f27515b7932bb2cf9e3082131a62daafdfe

CVE, Research URL: c1205f27515b7932bb2cf9e3082131a62daafdfe
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Apr 03, 2023
Research Description: MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system] < 2.9.35 MasterStudy LMS WordPress Plugin <= 2.9.34 - Missing Authorization via wp_ajax_stm_wpcfto_get_settings The MasterStudy LMS WordPress Plugin is vulnerable to unauthorized access of data due to a missing capability check on an anonymous function called by the stm_wpcfto_get_settings AJAX action in versions up to, and including, 2.9.345. This makes it possible for authenticated attackers with subscriber-level permissions or above to access settings data.
Affected versions: max 2.9.35.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # 9b4e341c2ec92e66350e8027601554ee2a863a3a

CVE, Research URL: 9b4e341c2ec92e66350e8027601554ee2a863a3a
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Apr 04, 2023
Research Description: MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system] < 2.9.35 WordPress MasterStudy LMS Plugin <= 2.9.34 is vulnerable to Broken Access Control Update the WordPress MasterStudy LMS plugin to the latest available version (at least 2.9.35). Unknown discovered and reported this Broken Access Control vulnerability in WordPress MasterStudy LMS Plugin. This vulnerability has been fixed in version 2.9.35.
Affected versions: max 2.9.35.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # ec94093db88b154d60efe598d24bfd6f4844e90d

CVE, Research URL: ec94093db88b154d60efe598d24bfd6f4844e90d
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Feb 28, 2022
Research Description: MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system] < 2.8.0 WordPress MasterStudy LMS plugin < 2.8.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress MasterStudy LMS plugin (versions < 2.8.0).
Affected versions: max 2.8.0.
Status: vulnerable

Jun 30, 2026

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2026-57330

CVE, Research URL: CVE-2026-57330
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Jun 29, 2026
Research Description: Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions.
Affected versions: max 3.7.28.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2026-57640

CVE, Research URL: CVE-2026-57640
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Jun 26, 2026
Research Description: Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.
Affected versions: max 3.7.31.
Status: vulnerable

Jul 29, 2026

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2026-5060

CVE, Research URL: CVE-2026-5060
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Jul 29, 2026
Research Description: The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the `stm_lms_delete_cover()` function lacking ownership validation on the `file_id` parameter before passing it to `wp_delete_attachment()`. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary attachments belonging to any user by enumerating sequential attachment IDs.
Affected versions: max 3.7.24.
Status: vulnerable

Aug 02, 2026

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2026-28145

CVE, Research URL: CVE-2026-28145
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Jul 31, 2026
Research Description: Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n/a through 3.7.39.
Affected versions: max 3.7.40.
Status: vulnerable

Aug 21, 2026

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2026-73404

CVE, Research URL: CVE-2026-73404
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Aug 18, 2026
Research Description: Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.
Affected versions: max 3.7.42.
Status: vulnerable

MasterStudy LMS WordPress Plugin – for Online Courses and Education # CVE-2026-68568

CVE, Research URL: CVE-2026-68568
Home page URL: Security reports for MasterStudy LMS WordPress Plugin – for Online Courses and Education
Application: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Date: Aug 18, 2026
Research Description: Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.
Affected versions: max 3.7.42.
Status: vulnerable