MasterStudy LMS CVE-2026-88845

Exploitation requires any authenticated WordPress account on the target site - even the lowest Subscriber role suffices (PR:L) - because the administrative maintenance action performs no capability check and no nonce verification. The practical prerequisite is therefore the ability to obtain a login: trivial on sites that allow open/self-service registration (common for LMS/course platforms) and a real limiter on sites where registration is closed. No user interaction, no special configuration, and no admin privileges are needed; the affected versions are MasterStudy LMS 2.3.0 through before 3.7.50. Impact is limited to creating published content attributed to the attacker's own account (integrity only).

This is a genuine but low-to-moderate priority issue, not an overstated high-CVSS finding. All signals align coherently: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable, low-complexity flaw requiring only low privileges (any authenticated account, e.g. a subscriber) with a single low integrity impact and no confidentiality or availability loss. CISA SSVC concurs - Exploitation: none, Automatable: no, Technical Impact: partial - pointing to no observed exploitation and limited blast radius. A public exploit exists (WPScan) and the SSVC 'Automatable: no' plus PR:L keep it from being mass-exploitable, since an attacker first needs a valid low-level account on the target site. No EPSS score is provided and the flaw is not in CISA KEV, so there is no evidence of active or widespread exploitation. The signals are consistent (no conflicts), so real-world urgency is driven mostly by whether a site allows open/self-service registration; on such sites the barrier is trivial, on registration-closed sites the PR:L requirement is a meaningful limiter.

On a MasterStudy LMS site that permits self-registration, an attacker registers a subscriber account and sends the administrative maintenance action request directly, which the plugin executes without any capability or nonce verification. The action publishes content on the site attributed to the attacker's account, enabling spam, SEO abuse, or planting misleading published posts. Publicly available exploit code (WPScan) lowers the effort required to reproduce this.