MasterStudy LMS CVE-2026-88848

Requires an authenticated MasterStudy LMS member account with any active membership plan on a site running the plugin between version 1.9 and 3.7.50. Exploitation involves submitting a course-enrollment request referencing a course not covered by the member's plan, or a plan identifier the member does not hold - the plugin performs no server-side check that the requested course belongs to the member's plan or that the supplied plan ID is theirs. Limiting factors: the attacker must be a registered/paying member (PR:L), impact is bounded to unauthorized access to paid course content and bypassing plan course-count limits (no host or admin compromise), and sites on 3.7.50 or later are not affected.

This is a low-to-moderate priority authorization flaw, not a critical one. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N = 4.2) describes a network-reachable but authenticated bug requiring an existing member account (PR:L) with only partial confidentiality and integrity impact and no availability impact. WPScan rates AC:H, though the described exploitation - submitting an enrollment request with a course or plan ID the member does not actually hold - reads as low-complexity parameter tampering, so AC:L is arguably more accurate (this is the one notable signal disagreement). Publicly available exploit code exists (WPScan), which raises real-world usability, but there is no EPSS score, no CISA KEV listing, and no SSVC data provided, so there is no evidence of active or automated exploitation. The business impact is meaningful for the affected site owner (revenue leakage - members bypassing paid-plan course limits) but the technical security impact on the host is limited: no RCE, no privilege escalation to admin, no site compromise. Net: a genuine broken-access-control/IDOR issue worth patching, especially on monetized LMS sites, but not an emergency relative to high-CVSS RCE-class bugs.

A user purchases or is granted the cheapest MasterStudy LMS membership plan, then sends an enrollment request naming a premium course (or a plan identifier) outside their entitlement. Because the plugin never verifies the course is covered by the member's plan or that the submitted plan ID belongs to them, the server enrolls them into restricted paid courses and past their plan's course limit. Public exploit detail is available via the WPScan advisory.