{"id":"CVE-2026-88849","kind":"vulnerability","aliases":["CVE-2026-88849"],"related":[],"title":"MasterStudy LMS WordPress plugin lets instructors rename any user","description":"The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.","summary":"Before version 3.7.55 of the MasterStudy LMS WordPress plugin, the student-enrolment feature does not check that the target user relates to the instructor making the request. A user with the Instructor role can overwrite the first name, last name and display name of any registered account, including administrators, which enables impersonation and phishing.","severity":"low","cvss":2.7,"epss":0.00168,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["masterstudy-lms","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["default-config","no-instructor-role-users"],"how_to_check":"- Check the installed MasterStudy LMS plugin version in the WordPress admin under Plugins, or with `wp plugin get masterstudy-lms-learning-management-system --field=version` (plugin slug assumed; confirm in the sources).\n- Review which accounts hold the Instructor role, for example with `wp user list --role=instructor`.","fix":"- Update the MasterStudy LMS WordPress plugin to `3.7.55` or later.\n- Until the update is applied, restrict or remove the Instructor role from untrusted accounts.","status":"open","published_at":"2026-10-22T06:17:15+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:47:58+00:00","updated_at":"2026-10-25T04:47:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:47:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update the MasterStudy LMS WordPress plugin to `3.7.55` or later.\n- Until the update is applied, restrict or remove the Instructor role from untrusted accounts.","reach":"internet","title":"MasterStudy LMS WordPress plugin lets instructors rename any user","impact":"medium","summary":"Before version 3.7.55 of the MasterStudy LMS WordPress plugin, the student-enrolment feature does not check that the target user relates to the instructor making the request. A user with the Instructor role can overwrite the first name, last name and display name of any registered account, including administrators, which enables impersonation and phishing.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","masterstudy-lms","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Instructor can rename any account, enabling impersonation and phishing of admins","analyst_note":"","how_to_check":"- Check the installed MasterStudy LMS plugin version in the WordPress admin under Plugins, or with `wp plugin get masterstudy-lms-learning-management-system --field=version` (plugin slug assumed; confirm in the sources).\n- Review which accounts hold the Instructor role, for example with `wp user list --role=instructor`.","needs_analyst":false,"not_affected_if":["default-config","no-instructor-role-users"],"who_is_affected":"Sites running the MasterStudy LMS WordPress plugin before 3.7.55 that give users the Instructor role. The flaw needs an account with that role, so sites that do not use the plugin's enrolment feature or do not assign the Instructor role to outside users carry lower practical risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00065,"input_tokens":3385,"output_tokens":622,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-88849':12A,15A '3.7.55':29B,90C 'account':74B 'administr':76B,136C 'allow':111C 'check':43B 'cve':10A,13A 'display':69B,126C 'enabl':78B,137C 'enrol':39B,102C 'featur':40B,103C 'first':64B,120C 'host':22B 'imperson':79B,138C 'includ':75B,135C 'instructor':6A,51B,59B,110C,115C 'last':66B,122C 'let':5A 'lms':2A,18B,33B,84C 'make':52B 'masterstudi':1A,17B,32B,83C 'masterstudy-lm':16B 'name':65B,67B,70B,121C,123C,127C 'overwrit':62B,118C 'packag':19B 'phish':81B,140C 'plugin':4A,26B,35B,86C,88C 'public':125C 'regist':73B,130C 'relat':48B 'relationship':106C 'renam':7A 'request':54B,109C 'role':60B,116C 'self':21B 'self-host':20B 'site':134C 'student':38B,101C 'student-enrol':37B,100C 'target':46B,97C 'user':9A,47B,56B,96C,112C,131C 'verifi':93C 'version':28B 'wordpress':3A,23B,25B,34B,85C,87C 'wordpress-plugin':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the MasterStudy LMS WordPress plugin before 3.7.55 that give users the Instructor role. The flaw needs an account with that role, so sites that do not use the plugin's enrolment feature or do not assign the Instructor role to outside users carry lower practical risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T06:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88849","severity":null,"published_at":"2026-10-22T06:17:15+00:00","modified_at":"2026-10-22T15:16:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-88849","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88849","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}