Security Alert Summary
The MasterStudy LMS WordPress Plugin before version 3.7.55 contains a vulnerability in its student-enrolment feature that allows users with the Instructor role to overwrite the first name, last name, and public display name of any registered user on the site, including administrators. This behavior can enable user impersonation and increase the risk of targeted phishing against site members.
CVE Details
- CVE ID: CVE-2026-88849
- Affected component: MasterStudy LMS WordPress Plugin
- Affected versions: Versions before 3.7.55 (example entry: 3.7.13 marked as affected with < 3.7.55)
- Published: October 22, 2026 at 6:17 AM (UTC)
- Last modified: October 22, 2026 at 3:16 PM (UTC)
- CVSS v3.1 base score: 2.7
- CVSS v3.1 severity: LOW
- CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- Authentication / privileges required / user interaction: Privileges Required: High (an authenticated user with the Instructor role is required). User Interaction: None.
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- Weakness (CWE): CWE-863
Technical Details
According to the vulnerability description, the plugin’s student-enrolment feature does not verify that the user targeted by an instructor has a relationship to, or is managed by, that instructor. Because of this missing verification, a user with the Instructor role can overwrite profile fields for any registered account on the site. The specific fields noted are the first name, last name, and public display name.
The lack of a check tying the targeted account to the requesting instructor is the root cause. The vulnerability allows authenticated instructors to modify visible identity attributes of other users without additional authorization checks. The impact is limited to integrity of user profile metadata (displayed names) and does not, in the provided data, indicate changes to passwords, email addresses, or direct privilege escalation.
How This Could Impact Your Website
Consider a site with multiple roles: a site owner, internal staff who manage courses, and external instructors or contractors. An instructor able to change another user’s public name can impersonate that user in visible areas such as course rosters, comments, or user lists. This can be used to mislead students or staff and increase the risk of targeted phishing or social engineering attacks that exploit perceived trust.
For example, an attacker operating from an Instructor account could rename their profile to match a site administrator or an internal staff member. Other users might then accept messages or requests appearing to come from that trusted identity, or attackers could craft messages that rely on the impersonated display name. If profile pages or user directories include contact information, impersonation can also make it easier to identify and target specific individuals.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for Instructor-level accounts and contributor-type roles.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and limit plugin installation to trusted sources.
- Monitor site activity and user profile changes for unusual behavior or unexpected name changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
