CVE-2026-88849: MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MasterStudy LMS WordPress Pluginto a version that resolves this vulnerability.Fixed in 3.7.55
Event History
Frequently Asked Questions
Which users can exploit this issue, and which accounts can they target?
A user with the Instructor role can exploit the issue. They can change the first name, last name, and public display name of any registered site user, including administrators.
Are standard student-enrolment restrictions sufficient to prevent exploitation?
No. The affected feature does not verify that the user selected through student enrolment has any relationship to the requesting instructor.
What is the practical impact of a successful exploit?
An attacker can alter identity-related profile fields used publicly by the site. This can enable impersonation and phishing, including by changing an administrator's displayed identity.
What version should be used to remediate the issue?
The issue affects versions before 3.7.55. Update MasterStudy LMS to version 3.7.55 or later.