WordPress MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion vulnerability

🗓️ 05 Jan 2026 22:41:00Reported by thinnawarth mathurosType

MasterStudy LMS plugin until 3.7.6 allows subscribers to create, modify or delete posts; fixed in 3.7.7.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-13766	6 Jan 202612:43	–	circl
CNNVD	WordPress plugin MasterStudy LMS WordPress Plugin – for Online Courses and Education 安全漏洞	6 Jan 202600:00	–	cnnvd
CVE	CVE-2025-13766	6 Jan 202608:21	–	cve
Cvelist	CVE-2025-13766 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion	6 Jan 202608:21	–	cvelist
EUVD	EUVD-2026-1068	6 Jan 202608:21	–	euvd
NVD	CVE-2025-13766	6 Jan 202609:15	–	nvd
Positive Technologies	PT-2026-1424	6 Jan 202600:00	–	ptsecurity
RedhatCVE	CVE-2025-13766	7 Jan 202609:16	–	redhatcve
Vulnrichment	CVE-2025-13766 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion	6 Jan 202608:21	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (January 5, 2026 to January 11, 2026)	15 Jan 202616:14	–	wordfence

Vulners

Node

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/masterstudy-lms-learning-management-system/masterstudy-lms-wordpress-plugin-for-online-courses-and-education-376-missing-authorization-to-authenticated-subscriber-posts-and-media-creation-modification-and-deletion

05 Jan 2026 22:41Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.15.4

EPSS0.00046

SSVC