MasterStudy LMS CVE-2026-73404

The attacker must possess a valid subscriber-level WordPress account on the target site - the CVSS PR:L metric confirms this as the required privilege level. Open subscriber registration is the default on many LMS deployments and constitutes the primary enabling condition. No special server-side feature toggle, non-default configuration, or specific plugin module needs to be active beyond running the vulnerable plugin version. Exploitation is limited to WordPress environments; users without any account cannot exploit this flaw. There is no user interaction requirement, meaning no administrator action is needed once the attacker is authenticated.

The CVSS 6.5 score is driven by an AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N vector, reflecting a network-reachable flaw requiring only a subscriber account and no user interaction, with high confidentiality impact but no write or availability consequences. This is consistent with a read-only authorization bypass, not a code execution or data-destruction scenario. EPSS data is absent from the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. There is no CISA KEV listing, and no proof-of-concept exploit code is identified in available sources. However, the low attack complexity and the prevalence of open registration on educational platforms mean that even a mid-sized municipal IT team in mielec running a public LMS should treat this as a meaningful priority if subscriber self-registration is enabled and sensitive learner or course data is in scope. The I:N rating limits blast radius compared to write-access flaws, but confidentiality exposure on LMS platforms routinely includes student PII, assessment results, and premium course content.

An attacker registers a free subscriber account on a target WordPress site running MasterStudy LMS 3.7.41, a common workflow on open-enrollment e-learning platforms. Authenticated as a subscriber, they send crafted HTTP requests to plugin endpoints that should be gated to instructor or administrator roles, bypassing the missing authorization check to retrieve sensitive records such as student data, hidden course materials, or internal configurations. No public exploit code is confirmed, but the low attack complexity and straightforward missing-authorization class make manual discovery and exploitation practical with basic web tooling.