CVE-2026-118092: WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through 3.7.55.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/masterstudy-lms-learning-management-systemto a version that resolves this vulnerability.Fixed in 3.7.56
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires low-level privileges. It is remotely exploitable and does not require user interaction.
What impact is described if the issue is exploited?
The reported impact is limited confidentiality loss. No integrity or availability impact is indicated by the supplied CVSS vector.
Which plugin versions are affected?
MasterStudy LMS versions through 3.7.55 are affected. The supplied data does not identify a fixed version.