CVE-2026-73404

Subscriber users of MasterStudy LMS plugin

EUVD-2026-60807

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-73404 WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-73404

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-68568 WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

EUVD-2026-60936

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

CVE-2026-68568

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

CVE-2026-68568 WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

CVE-2026-68568

WordPress MasterStudy LMS plugin (≤ 3.7.41) allows authenticated subscribers to escalate privileges, likely by bypassing capability checks in REST endpoints or AJAX handlers. CVSS 6.3 (medium) — network attack, low privileges required. No in-the-wild exploitation reported. Upgrade to a patched ve...

WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dutafi in WordPress Plugin MasterStudy LMS versions = 3.7.41...

WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by dutafi in WordPress Plugin MasterStudy LMS versions = 3.7.41...

PT-2026-77121

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

PT-2026-77079

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

CVE-2026-68568: Incorrect Privilege Assignment

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

CVE-2026-73404: Missing Authorization

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-28145: Insufficient Verification of Data Authenticity

Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n/a through 3.7.39...

CVE-2026-5060 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stmlmsdeletecover function lacking ownership validation on the fileid parameter before...

PT-2026-65775

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stm lms delete cover function lacking ownership validation on the file id parameter befor...

CVE-2026-5060: Authorization Bypass Through User-Controlled Key

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stmlmsdeletecover function lacking ownership validation on the fileid parameter before...

WordPress MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.7.23 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion vulnerability

Insecure Direct Object Reference to Authenticated Instructor+ Arbitrary Attachment Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin MasterStudy LMS versions = 3.7.23...