MasterStudy LMS EUVD-2026-60936

Exploitation requires a valid subscriber-level account on the target WordPress installation running MasterStudy LMS version 3.7.41 or earlier. The CVSS vector (PR:L) confirms that low-privilege authentication is a hard prerequisite - unauthenticated exploitation is not supported by the available data. On WordPress sites where open user registration is enabled, this barrier is trivial to overcome, as attackers can self-register without administrator approval. No non-default configuration, special plugin feature enablement, or specific server environment is described as a prerequisite beyond the presence of the affected plugin version. Exploitation is limited to the scope of the MasterStudy LMS plugin functionality (S:U); full WordPress administrator takeover is not confirmed from the available description.

The CVSS 3.1 score of 6.3 (Medium) reflects a network-accessible flaw requiring low-privilege authentication (PR:L) with no user interaction, and bounded confidentiality, integrity, and availability impacts. The attack surface is broad because subscriber accounts can typically be self-registered on WordPress sites with open registration, effectively reducing the authentication barrier to near zero for opportunistic attackers. No EPSS data was provided in the available intelligence, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The absence of a reported public proof-of-concept further tempers urgency, though the limited complexity means that even a mid-sized municipal IT team in legnica running an e-learning platform should treat this as a near-term patching priority given how readily subscriber accounts can be provisioned. The unchanged scope (S:U) and the fact that impact is limited rather than full privilege escalation to administrator level are the primary factors keeping this at Medium severity despite its accessible network attack vector.

An attacker registers a free subscriber account on a publicly accessible WordPress site running MasterStudy LMS 3.7.41 or earlier, then issues crafted authenticated requests to a privileged endpoint that lacks proper capability enforcement. Leveraging the incorrect privilege assignment, the attacker gains access to instructor- or manager-level functionality, enabling modification of course content, access to student data, or further lateral movement within the WordPress environment. No public exploit has been identified at time of analysis, but the low attack complexity makes this reproducible by any attacker with basic WordPress familiarity.