MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.54 - Authenticated (Instructor+) Insecure Direct Object Reference to User Profile Name Modification via Manage Students
- ID
- WPSEC-2026-1287
- Plugin
- MasterStudy LMS WordPress Plugin – for Online Courses and Education (masterstudy-lms-learning-management-system)
- Affected
- all versions before 3.7.55
- Remediation
- Update to 3.7.55 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- MasterStudy LMS WordPress Plugin – for Online Courses and Education on WPSec AttackSurface
- Fix released
- Published
Description
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference via the single and bulk student enrollment REST endpoints (/student/{course_id} and /student/bulk/{course_id}) in all versions up to, and including, 3.7.54. This is due to the enrollment code updating the first name, last name and display name of an existing account, identified only by the supplied e-mail address, whenever that account was already enrolled in the course, without checking that the instructor has any authority over that account. This makes it possible for authenticated attackers with instructor-level access and above to enroll any existing user, including administrators, in one of their own courses and then overwrite that user's first name, last name and display name.
References
- https://wpsec.com/vuln/WPSEC-2026-1287/
- https://plugins.svn.wordpress.org/masterstudy-lms-learning-management-system/tags/3.7.55/
- https://wordpress.org/plugins/masterstudy-lms-learning-management-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS