Skip to main content

MasterStudy LMS EUVDEUVD-2026-60936

| CVE-2026-68568 MEDIUM
Incorrect Privilege Assignment (CWE-266)
2026-08-18 Patchstack GHSA-v52j-xq42-w6f9
WordPress Privilege Escalation Masterstudy Lms Wordpress Plugin Stylemix
6.3
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
6.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
vuln.today AI
6.3 MEDIUM

Network vector applies as WordPress operates over HTTP; PR:L reflects mandatory subscriber authentication; limited CIA impacts reflect partial privilege gain within plugin scope only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

1
Analysis Generated
Aug 18, 2026 - 15:38 vuln.today

DescriptionCVE.org

Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.

AnalysisAI

Privilege escalation in the MasterStudy LMS WordPress plugin (versions up to and including 3.7.41) enables authenticated subscriber-level users to exceed their intended permissions through incorrect privilege assignment (CWE-266). Discovered and disclosed by Patchstack and tracked as ENISA EUVD-2026-60936, the flaw affects deployments by Stylemix on the WordPress platform worldwide. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid subscriber-level account on the target WordPress installation running MasterStudy LMS version 3.7.41 or earlier. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 6.3 (Medium) reflects a network-accessible flaw requiring low-privilege authentication (PR:L) with no user interaction, and bounded confidentiality, integrity, and availability impacts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Patch available per vendor advisory - administrators should update MasterStudy LMS to a version released after 3.7.41 via the WordPress plugin repository or the Stylemix plugin page as soon as a confirmed fixed release is available. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Masterstudy Lms

View all
CVE-2024-1512 CRITICAL POC
9.8 Feb 17

The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
CVE-2024-3136 CRITICAL POC
9.8 Apr 09

The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3
CVE-2022-0441 CRITICAL POC
9.8 Mar 07

The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account,
CVE-2024-5973 HIGH POC
8.8 Jul 22

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.3.24 does not prevent students from creating instructor a
CVE-2023-4278 HIGH POC
7.5 Sep 11

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registra
CVE-2024-2411 CRITICAL
9.8 Mar 29

The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3
CVE-2024-2409 CRITICAL
9.8 Mar 29

The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3
CVE-2024-37094 CRITICAL
9.8 Nov 01

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Co
CVE-2026-78284 HIGH
8.6 Aug 24

Unauthenticated arbitrary file deletion in the MasterStudy LMS WordPress plugin (versions ≤ 3.7.42) allows remote, unaut
CVE-2026-40766 HIGH
8.5 Jun 15

SQL injection in the MasterStudy LMS WordPress plugin (versions 3.7.25 and earlier) allows authenticated users at the Su
CVE-2026-73404 MEDIUM
6.5 Aug 18

Broken Access Control in the MasterStudy LMS WordPress plugin (versions up to and including 3.7.41) permits any authenti
CVE-2026-57330 MEDIUM
6.5 Jun 29

Stored Cross-Site Scripting in the MasterStudy LMS WordPress plugin (versions <= 3.7.27) allows authenticated subscriber

Same weakness CWE-266 – Incorrect Privilege Assignment

View all
CVE-2025-27007 CRITICAL POC
9.8
CVE-2024-28000 CRITICAL POC
9.8
CVE-2026-48172 CRITICAL POC
10.0
CVE-2024-24882 CRITICAL POC
9.8
CVE-2025-47539 CRITICAL POC
9.8
CVE-2022-20759 HIGH POC
8.8
CVE-2024-54363 CRITICAL
9.8
CVE-2026-23550 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

EUVD-2026-60936 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy