MasterStudy LMS CVE-2026-88847

Requires an authenticated WordPress account of any privilege level (a self-registered subscriber suffices, matching PR:L); no administrative rights and no user interaction are needed. Exploitation targets the lesson-completion functionality of the MasterStudy LMS plugin (versions before 3.7.50), where the enrollment check is absent by design in vulnerable versions - no special configuration is required beyond the plugin being installed and open self-registration or an existing low-privilege account. The main limiting factors are the authentication requirement and that impact is confined to course-progress data integrity (no confidentiality or availability effect); sites that disable user self-registration further raise the barrier to obtaining the needed account.

This is a genuine but low-severity data-integrity flaw, not a high-priority emergency. All signals align coherently at the low end: the CVSS 3.1 vector (4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) shows a remotely reachable, low-complexity issue that nonetheless requires an authenticated account (PR:L) and yields only limited integrity impact with zero confidentiality or availability impact. This matches CWE-862 (missing authorization): the plugin records lesson completions without verifying enrollment. CISA SSVC reinforces the low priority - Exploitation: none, Automatable: no, Technical Impact: partial. A public exploit exists and the vendor has patched (3.7.50), but public exploit code is a distinct signal from active exploitation: there is no CISA KEV listing and no EPSS score provided, so there is no evidence of real-world exploitation. The realistic worst case is polluted or fraudulent course-progress/completion data (e.g., marking uncompleted lessons as done), which is an integrity nuisance on an LMS rather than a route to code execution, data theft, or service disruption. Bottom line: a legitimate bug worth patching in routine cycles, but low urgency given the authenticated prerequisite and integrity-only impact.

A user self-registers or already holds a low-privilege subscriber account on a WordPress site running MasterStudy LMS, then sends crafted requests to the lesson-completion endpoint for courses they are not enrolled in. Because the plugin never checks enrollment, the server records bogus progress/completion entries, potentially yielding fraudulent completion status or certificates and corrupting course analytics. Public exploit code is available (WPScan), lowering the effort required, though the attacker must first hold a valid authenticated account.