What is the CVSS score of CVE-2026-28145?

CVE-2026-28145 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

MasterStudy LMS CVE-2026-28145

EUVD-2026-51536 MEDIUM

Insufficient Verification of Data Authenticity (CWE-345)

2026-07-31 Patchstack

GHSA-f3rr-323h-3jm2

WordPress Information Disclosure Masterstudy Lms Wordpress Plugin Stylemixthemes

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible with no auth required (PR:N), low complexity; integrity-only impact (I:L) since only user state is altered, not confidentiality or availability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 14:20 vuln.today

DescriptionCVE.org

Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State.

This issue affects MasterStudy LMS: from n/a through 3.7.39.

AnalysisAI

Unauthenticated remote manipulation of user state is possible in StylemixThemes MasterStudy LMS WordPress plugin through version 3.7.39, due to insufficient verification of data authenticity (CWE-345). The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication or user interaction is required, allowing any network-accessible attacker to tamper with LMS user state - such as enrollment records, course progress, or quiz scores. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this straightforward to abuse against unpatched installations.

Technical ContextAI

CWE-345 (Insufficient Verification of Data Authenticity) indicates the plugin fails to adequately validate that incoming data originates from a trusted or authorized source before acting on it - a class of broken access control flaw common in WordPress plugins that rely on client-supplied parameters without server-side verification. The affected product is the MasterStudy LMS plugin by StylemixThemes (CPE: cpe:2.3:a:stylemixthemes:masterstudy_lms:*:*:*:*:*:*:*:*), a Learning Management System plugin for WordPress used to deliver online courses, quizzes, and student progress tracking. The specific exploitation surface - 'Manipulating User State' - suggests that the plugin processes data (such as enrollment status, course completion flags, or quiz results) that can be forged or replayed by an external actor without proper nonce, capability, or ownership checks. This is consistent with the Patchstack classification of a broken access control vulnerability.

RemediationAI

Upstream fix availability has not been independently confirmed from the input data - no exact patched version number is provided in the Patchstack advisory reference or NVD entry. Administrators should update the MasterStudy LMS plugin to a version beyond 3.7.39 and verify the fix via the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-7-39-broken-access-control-vulnerability. If an updated version is not yet available, compensating controls include restricting access to LMS state-change endpoints via a Web Application Firewall (WAF) rule targeting unauthenticated POST requests to affected plugin routes, and auditing LMS enrollment and completion records for anomalous entries. Note that WAF-based restrictions may interfere with legitimate unauthenticated workflows if the plugin supports guest enrollment or anonymous progress tracking.