CVE-2026-88843: MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MasterStudy LMS WordPress Pluginto a version that resolves this vulnerability.Fixed in 3.7.50
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker must be authenticated as a WordPress user with the Contributor role or a higher-privileged role. The available information does not indicate that unauthenticated users can exploit it.
Does an earlier fix for a related issue fully address this exposure?
No. An equivalent template-path handling issue was corrected earlier, but this code path remained vulnerable, including in versions that the earlier advisory reported as fixed.
How can I determine whether an installation needs remediation?
Check the installed MasterStudy LMS plugin version. Versions earlier than 3.7.50 are affected and should be updated to 3.7.50 or later.