Live › vulnerability › CVE-2026-88849
Go to dashboardBefore version 3.7.55 of the MasterStudy LMS WordPress plugin, the student-enrolment feature does not check that the target user relates to the instructor making the request. A user with the Instructor role can overwrite the first name, last name and display name of any registered account, including administrators, which enables impersonation and phishing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the MasterStudy LMS WordPress plugin before 3.7.55 that give users the Instructor role. The flaw needs an account with that role, so sites that do not use the plugin's enrolment feature or do not assign the Instructor role to outside users carry lower practical risk.
No product ranges from the sources yet.
wp plugin get masterstudy-lms-learning-management-system --field=version (plugin slug assumed; confirm in the sources).wp user list --role=instructor.3.7.55 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.
This page as .md · .json · in your agent: get_signal("CVE-2026-88849")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.