Security Alert Summary
The MasterStudy LMS WordPress Plugin before version 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions. This allows any authenticated user, such as a subscriber, to create course progress records for courses they have no access to, potentially corrupting course completion data.
CVE Details
- CVE ID: CVE-2026-88847
- Affected plugin: MasterStudy LMS WordPress Plugin
- Affected versions: Versions before 3.7.50
- Published: September 24, 2026 at 06:17:03 AM UTC
- Last modified: September 24, 2026 at 02:42:02 PM UTC
- CVSS v3.1: Base score 4.3 (MEDIUM) – Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Authentication / Privileges / User interaction: Privileges required: LOW; User interaction: NONE
- Primary impact: Integrity: LOW; Confidentiality: NONE; Availability: NONE
- Weakness (CWE): CWE-862
- SSVC notes: exploitation: none; automatable: no; technical impact: partial
Technical Details
According to the advisory, the plugin does not confirm that a user is enrolled in a course before writing lesson completion records. The missing enrollment verification allows any authenticated account to create course progress entries for courses they do not have access to. The issue arises from insufficient access control checks around the functionality that records lesson completions.
The practical impact is limited to modification of course progress data: an attacker with a low-privilege account can add or alter completion records for courses they are not enrolled in. There is no direct confidentiality or availability impact reported in the CVSS data.
How This Could Impact Your Website
Consider a site with an owner, internal course managers, and external contributors: a low-privilege user (for example, a subscriber or external contributor) could mark lessons as completed for courses they have not been granted access to. This can lead to inaccurate progress reporting and may interfere with administrative workflows that rely on correct completion status.
Although CVSS indicates no direct confidentiality impact, manipulated progress data can assist attackers in crafting social engineering or phishing campaigns by revealing active users or patterns of activity. In combination with other site features, this could contribute to exposure of internal user email addresses or increased risk of targeted phishing.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and privileges, especially for contributors and subscribers.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and logs for unusual behavior related to course progress or account activity.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
