CVE-2026-88844 in MasterStudy LMS Plugin
Summary
by MITRE • 09/18/2026
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified within versions of the MasterStudy Learning Management System (LMS) for WordPress prior to version 3.7.50 represents a critical failure in server-side access control logic, specifically categorized under CWE-284 Improper Access Control and often referred to as an Insecure Direct Object Reference or IDOR flaw. This security defect arises from the application's inability to properly validate whether the authenticated user initiating a request possesses legitimate ownership or administrative rights over the specific course resource being accessed. The core technical issue lies in the backend API endpoints responsible for retrieving enrolled student data, which accept parameters identifying a target course but fail to cross-reference these identifiers against the instructor ID associated with the currently logged-in session. Consequently, an attacker operating under the Instructor role can manipulate request parameters to query courses belonging to other instructors within the same WordPress installation.
From an operational perspective, this vulnerability allows for significant data leakage and privacy violations. Users possessing the standard Instructor privilege level, which is typically granted to content creators rather than site administrators, are able to bypass intended isolation boundaries between different course offerings. By exploiting this flaw, malicious actors can extract sensitive personally identifiable information (PII) of students enrolled in courses they do not teach or manage. The disclosed data includes student names and email addresses, which constitutes a direct violation of privacy regulations such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), depending on the jurisdiction of the affected users. This exposure not only compromises individual user privacy but also erodes trust in the platform's ability to secure educational data.
The exploitation vector for this vulnerability is relatively straightforward and does not require complex technical skills, aligning with techniques observed in MITRE ATT&CK framework under T1078 Valid Accounts or potentially T1530 Data from Local System if combined with other local exploits, though primarily it falls under unauthorized access to sensitive data. An attacker simply needs valid credentials for an Instructor account and knowledge of the course IDs associated with other instructors' courses. Once authenticated, the attacker can iterate through potential course identifiers to compile a comprehensive list of student contact information across multiple classes. This capability transforms a standard role-based permission error into a scalable method for harvesting large volumes of personal data without detection by default logging mechanisms that may not flag legitimate instructor activity patterns.
To mitigate this vulnerability and restore secure access controls, immediate action is required from system administrators and developers maintaining the WordPress environment. The primary remediation step involves upgrading the MasterStudy LMS plugin to version 3.7.50 or later, where the vendor has implemented proper authorization checks to ensure that only users with explicit ownership of a course can retrieve its associated student enrollment data. In addition to patching, organizations should enforce strict principle of least privilege by reviewing user roles and ensuring that instructors are not granted unnecessary permissions beyond their specific teaching assignments. Furthermore, implementing robust input validation on the server side for all API endpoints handling sensitive data is essential. Security teams should also monitor logs for anomalous patterns in student data retrieval requests to detect any potential exploitation attempts before they result in significant data breaches.