{
 "id": "WPSEC-2026-1287",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1287/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1287/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1287/index.md",
 "title": "MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.54 - Authenticated (Instructor+) Insecure Direct Object Reference to User Profile Name Modification via Manage Students",
 "description": "The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference via the single and bulk student enrollment REST endpoints (/student/{course_id} and /student/bulk/{course_id}) in all versions up to, and including, 3.7.54. This is due to the enrollment code updating the first name, last name and display name of an existing account, identified only by the supplied e-mail address, whenever that account was already enrolled in the course, without checking that the instructor has any authority over that account. This makes it possible for authenticated attackers with instructor-level access and above to enroll any existing user, including administrators, in one of their own courses and then overwrite that user's first name, last name and display name.",
 "plugin": {
  "slug": "masterstudy-lms-learning-management-system",
  "name": "MasterStudy LMS WordPress Plugin – for Online Courses and Education",
  "full_name": "MasterStudy LMS WordPress Plugin – for Online Courses and Education",
  "wordpress_org": "https://wordpress.org/plugins/masterstudy-lms-learning-management-system/",
  "advisories_url": "https://wpsec.com/vuln/plugin/masterstudy-lms-learning-management-system/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/masterstudy-lms-learning-management-system"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.7.55",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.7.55"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.7.55",
 "remediation": "Update to 3.7.55 or later.",
 "fix_released": "2026-10-19T10:48:59+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:34:22.951798+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1287/",
  "https://plugins.svn.wordpress.org/masterstudy-lms-learning-management-system/tags/3.7.55/",
  "https://wordpress.org/plugins/masterstudy-lms-learning-management-system/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/masterstudy-lms-learning-management-system",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}