CVE-2026-80069

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...