# MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.54 - Authenticated (Instructor+) Insecure Direct Object Reference to User Profile Name Modification via Manage Students

- **ID:** WPSEC-2026-1287
- **Plugin:** MasterStudy LMS WordPress Plugin – for Online Courses and Education (`masterstudy-lms-learning-management-system`), https://wordpress.org/plugins/masterstudy-lms-learning-management-system/
- **Affected versions:** all versions before 3.7.55
- **Fixed in:** 3.7.55 (Update to 3.7.55 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/masterstudy-lms-learning-management-system
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1287/

## Description

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference via the single and bulk student enrollment REST endpoints (/student/{course_id} and /student/bulk/{course_id}) in all versions up to, and including, 3.7.54. This is due to the enrollment code updating the first name, last name and display name of an existing account, identified only by the supplied e-mail address, whenever that account was already enrolled in the course, without checking that the instructor has any authority over that account. This makes it possible for authenticated attackers with instructor-level access and above to enroll any existing user, including administrators, in one of their own courses and then overwrite that user's first name, last name and display name.

## References

- https://wpsec.com/vuln/WPSEC-2026-1287/
- https://plugins.svn.wordpress.org/masterstudy-lms-learning-management-system/tags/3.7.55/
- https://wordpress.org/plugins/masterstudy-lms-learning-management-system/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1287/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.