---
id: "CVE-2026-88849"
kind: "vulnerability"
aliases: ["CVE-2026-88849"]
title: "MasterStudy LMS WordPress plugin lets instructors rename any user"
severity: "low"
cvss: 2.7
epss: 0.00168
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["masterstudy-lms", "package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["default-config", "no-instructor-role-users"]
published_at: "2026-10-22T06:17:15+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:47:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88849", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-88849", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# MasterStudy LMS WordPress plugin lets instructors rename any user

Before version 3.7.55 of the MasterStudy LMS WordPress plugin, the student-enrolment feature does not check that the target user relates to the instructor making the request. A user with the Instructor role can overwrite the first name, last name and display name of any registered account, including administrators, which enables impersonation and phishing.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed MasterStudy LMS plugin version in the WordPress admin under Plugins, or with `wp plugin get masterstudy-lms-learning-management-system --field=version` (plugin slug assumed; confirm in the sources).
- Review which accounts hold the Instructor role, for example with `wp user list --role=instructor`.

## Fix

- Update the MasterStudy LMS WordPress plugin to `3.7.55` or later.
- Until the update is applied, restrict or remove the Instructor role from untrusted accounts.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88849
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-88849

## From the sources

The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_