MasterStudy LMS CVE-2026-88844

Requires an authenticated account holding the MasterStudy LMS 'Instructor' role on a site running the plugin before version 3.7.50 (affected from 3.6.2). The attacker must reference a course owned by a different instructor; the vulnerable endpoint returns enrolled-student data without verifying course ownership. Limiting factors: exploitation is gated on holding an Instructor-role account (not available to anonymous visitors or plain subscribers), and impact is confined to disclosure of student names and email addresses - no write access, no privilege escalation, and no availability impact. Sites that do not grant or allow self-registration of the Instructor role substantially reduce exposure.

This is a genuinely low-severity issue that should not be a top priority despite a public POC. The CVSS vector (AV:N/AC:L/PR:H/UI:N) describes a network-reachable, low-complexity attack but requires privileged access - a MasterStudy LMS Instructor-role account - and yields only confidentiality impact (C:L, I:N, A:N). The impact is a cross-tenant IDOR (CWE-639): an authenticated instructor reads the names and email addresses of students enrolled in OTHER instructors' courses, i.e. PII disclosure, not code execution or data modification. Publicly available exploit code exists (WPScan), which raises practical exploitability, but no EPSS score and no CISA KEV listing are provided, so there is no evidence of active or widespread exploitation. Signals are consistent: a low-CVSS, privilege-gated PII leak with a POC but no exploitation telemetry. One point of tension worth noting: the vendor's PR:H rating is debatable - Instructor is a mid-tier granted role rather than an administrator, so PR:L is arguably more accurate, which would raise the base score modestly; verify the exact privilege of the Instructor role in your deployment.

An attacker obtains or registers a MasterStudy LMS Instructor account on a target WordPress site (instructor registration is a common feature on LMS sites). They invoke the enrolled-student data endpoint referencing a course_id belonging to a different instructor; because ownership is never checked, the server returns the names and email addresses of students enrolled in that course. Publicly available exploit code from WPScan demonstrates the request.