Is MasterStudy LMS WordPress Plugin safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (3.7.58). As of 2026-11-04. 53 issues are on record for older versions; version 3.7.56 or newer fixes all of them that state a fix. Keep MasterStudy LMS WordPress Plugin on the latest version (3.7.58) and remove it if you do not use it.

Which versions of MasterStudy LMS WordPress Plugin are vulnerable?

Known issues on record (newest first): PHP object injection (3.7.55 and older, fixed in 3.7.56); Missing authorization check (3.7.55 and older, fixed in 3.7.56); Missing authorization check (3.7.13 up to (not including) 3.7.55, fixed in 3.7.55); Stored cross-site scripting (XSS) (3.7.52 and older, fixed in 3.7.53); Path traversal / file read (3.5.29 up to (not including) 3.7.50, fixed in 3.7.50); Missing authorization check (2.3.0 up to (not including) 3.7.50, fixed in 3.7.50). The full list with sources is on this page.

What is the latest version of MasterStudy LMS WordPress Plugin?

3.7.58, according to wordpress.org (last updated 2026-11-02). It has 10,000+ active installs.

What should I do if my MasterStudy LMS WordPress Plugin is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update masterstudy-lms-learning-management-system). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · masterstudy-lms-learning-management-system · data as of 2026-11-04

Is MasterStudy LMS WordPress Plugin safe? Known vulnerabilities and latest version

Latest version: 3.7.58
Last updated: 2026-11-02
Active installs: 10,000+
Known issues on record: 53
Unpatched in latest: 0
Tested up to WP: 7.0.8 · PHP 7.4+

Learning Management System and eLearning plugin for WordPress. Create easily LMS WordPress website, add and sell Courses, Lessons, Quizzes online. — by Stylemix

What to do

Update to the latest version (3.7.58). Anything older than 3.7.56 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get masterstudy-lms-learning-management-system --field=version shows what you run; wp plugin update masterstudy-lms-learning-management-system updates it.

Check your version

Known vulnerabilities

53 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

high 8.8 CVE-2026-118090 · published 2026-10-30

PHP object injection in MasterStudy LMS WordPress Plugin (3.7.55 and older)

Affected: 3.7.55 and older
Fixed in: 3.7.56
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.

NVD CVE-2026-118090 Patchstack advisory

medium 4.3 CVE-2026-118092 · published 2026-10-29

Missing authorization check in MasterStudy LMS WordPress Plugin (3.7.55 and older)

Affected: 3.7.55 and older
Fixed in: 3.7.56
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through 3.7.55.

NVD CVE-2026-118092 Patchstack advisory

low 2.7 CVE-2026-88849 · published 2026-10-22

Missing authorization check in MasterStudy LMS WordPress Plugin (3.7.13 up to (not including) 3.7.55)

Affected: 3.7.13 up to (not including) 3.7.55
Fixed in: 3.7.55
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.

NVD CVE-2026-88849 WPScan advisory

medium 6.5 CVE-2026-105079 · published 2026-10-08

Stored cross-site scripting (XSS) in MasterStudy LMS WordPress Plugin (3.7.52 and older)

Affected: 3.7.52 and older
Fixed in: 3.7.53
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52.

NVD CVE-2026-105079 Patchstack advisory

high 7.2 CVE-2026-88843 · published 2026-09-24

Path traversal / file read in MasterStudy LMS WordPress Plugin (3.5.29 up to (not including) 3.7.50)

Affected: 3.5.29 up to (not including) 3.7.50
Fixed in: 3.7.50
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed.

NVD CVE-2026-88843 WPScan advisory

medium 4.3 CVE-2026-88845 · published 2026-09-24

Missing authorization check in MasterStudy LMS WordPress Plugin (2.3.0 up to (not including) 3.7.50)

Affected: 2.3.0 up to (not including) 3.7.50
Fixed in: 3.7.50
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account.

NVD CVE-2026-88845 WPScan advisory

medium 5.3 CVE-2026-88846 · published 2026-09-24

Missing authorization check in MasterStudy LMS WordPress Plugin (2.3.0 up to (not including) 3.7.50)

Affected: 2.3.0 up to (not including) 3.7.50
Fixed in: 3.7.50
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled.

NVD CVE-2026-88846 WPScan advisory

medium 4.3 CVE-2026-88847 · published 2026-09-24

Missing authorization check in MasterStudy LMS WordPress Plugin (older than 3.7.50)

Affected: older than 3.7.50
Fixed in: 3.7.50
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to.

NVD CVE-2026-88847 WPScan advisory

medium 4.6 CVE-2026-81338 · published 2026-09-23

Content injection in MasterStudy LMS WordPress Plugin (older than 3.7.50)

Affected: older than 3.7.50
Fixed in: 3.7.50
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.

NVD CVE-2026-81338 WPScan advisory

medium 4.3 CVE-2026-81339 · published 2026-09-23

Missing authorization check in MasterStudy LMS WordPress Plugin (older than 3.7.50)

Affected: older than 3.7.50
Fixed in: 3.7.50
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal (subscriber) role to read other students' quiz grades, pass/fail status and attempt timestamps by referencing an attempt identifier belonging to another user.

NVD CVE-2026-81339 WPScan advisory

low 2.7 CVE-2026-88844 · published 2026-09-18

Missing authorization check in MasterStudy LMS WordPress Plugin (3.6.2 up to (not including) 3.7.50)

Affected: 3.6.2 up to (not including) 3.7.50
Fixed in: 3.7.50
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.

NVD CVE-2026-88844 WPScan advisory

low 3.8 CVE-2026-81340 · published 2026-09-18

Missing authorization check in MasterStudy LMS WordPress Plugin (older than 3.7.50)

Affected: older than 3.7.50
Fixed in: 3.7.50
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.

NVD CVE-2026-81340 WPScan advisory

medium 5.3 CVE-2026-81199 · published 2026-09-02

Information disclosure in MasterStudy LMS WordPress Plugin (older than 3.7.46)

Affected: older than 3.7.46
Fixed in: 3.7.46
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user.

NVD CVE-2026-81199 WPScan advisory

medium 4.3 CVE-2026-81194 · published 2026-09-02

Missing authorization check in MasterStudy LMS WordPress Plugin (older than 3.7.46)

Affected: older than 3.7.46
Fixed in: 3.7.46
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier.

NVD CVE-2026-81194 WPScan advisory

medium 5.3 CVE-2026-81195 · published 2026-09-02

Information disclosure in MasterStudy LMS WordPress Plugin (older than 3.7.46)

Affected: older than 3.7.46
Fixed in: 3.7.46
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user.

NVD CVE-2026-81195 WPScan advisory

low 2.7 CVE-2026-81196 · published 2026-09-02

Missing authorization check in MasterStudy LMS WordPress Plugin (older than 3.7.46)

Affected: older than 3.7.46
Fixed in: 3.7.46
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations.

NVD CVE-2026-81196 WPScan advisory

medium 5.3 CVE-2026-81197 · published 2026-09-02

Information disclosure in MasterStudy LMS WordPress Plugin (older than 3.7.46)

Affected: older than 3.7.46
Fixed in: 3.7.46
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.

NVD CVE-2026-81197 WPScan advisory

low 3.8 CVE-2026-81198 · published 2026-09-02

Missing authorization check in MasterStudy LMS WordPress Plugin (older than 3.7.46)

Affected: older than 3.7.46
Fixed in: 3.7.46
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other instructors.

NVD CVE-2026-81198 WPScan advisory

low 2.7 CVE-2026-81200 · published 2026-08-29

Missing authorization check in MasterStudy LMS WordPress Plugin (older than 3.7.42)

Affected: older than 3.7.42
Fixed in: 3.7.42
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order IDs.

NVD CVE-2026-81200 WPScan advisory

medium 4.7 CVE-2026-81342 · published 2026-08-29

Open redirect in MasterStudy LMS WordPress Plugin (older than 3.7.43)

Affected: older than 3.7.43
Fixed in: 3.7.43
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs.

NVD CVE-2026-81342 WPScan advisory

medium 4.8 CVE-2026-81026 · published 2026-08-29

Missing authorization check in MasterStudy LMS WordPress Plugin (older than 3.7.40)

Affected: older than 3.7.40
Fixed in: 3.7.40
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.

NVD CVE-2026-81026 WPScan advisory

high 8.6 CVE-2026-78284 · published 2026-08-24

Arbitrary file deletion in MasterStudy LMS WordPress Plugin (3.7.42 and older)

Affected: 3.7.42 and older
Fixed in: 3.7.43
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.

NVD CVE-2026-78284 Patchstack advisory

medium 6.5 CVE-2026-73404 · published 2026-08-18

Missing authorization check in MasterStudy LMS WordPress Plugin (3.7.41 and older)

Affected: 3.7.41 and older
Fixed in: 3.7.42
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.

NVD CVE-2026-73404 Patchstack advisory

medium 6.3 CVE-2026-68568 · published 2026-08-18

Privilege escalation in MasterStudy LMS WordPress Plugin (3.7.41 and older)

Affected: 3.7.41 and older
Fixed in: 3.7.42
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.

NVD CVE-2026-68568 Patchstack advisory

medium 5.3 CVE-2026-28145 · published 2026-07-31

Security issue in MasterStudy LMS WordPress Plugin (3.7.39 and older)

Affected: 3.7.39 and older
Fixed in: 3.7.40
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n/a through 3.7.39.

NVD CVE-2026-28145 Patchstack advisory

medium 6.5 CVE-2026-5060 · published 2026-07-29

Missing authorization check in MasterStudy LMS WordPress Plugin (3.7.23 and older)

Affected: 3.7.23 and older
Fixed in: 3.7.24 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the `stm_lms_delete_cover()` function lacking ownership validation on the `file_id` parameter before passing it to `wp_delete_attachment()`. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary attachments belonging to any user by enumerating sequential attachment IDs.

NVD CVE-2026-5060 Wordfence advisory Code change (fix)Plugin source

medium 6.5 CVE-2026-57330 · published 2026-06-29

Cross-site scripting (XSS) in MasterStudy LMS WordPress Plugin (3.7.27 and older)

Affected: 3.7.27 and older
Fixed in: 3.7.28
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions.

NVD CVE-2026-57330 Patchstack advisory

medium 4.3 CVE-2026-57640 · published 2026-06-26

Missing authorization check in MasterStudy LMS WordPress Plugin (3.7.30 and older)

Affected: 3.7.30 and older
Fixed in: 3.7.31
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.

NVD CVE-2026-57640 Patchstack advisory

high 8.5 CVE-2026-40766 · published 2026-06-15

SQL injection in MasterStudy LMS WordPress Plugin (3.7.25 and older)

Affected: 3.7.25 and older
Fixed in: 3.7.26
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.

NVD CVE-2026-40766 Patchstack advisory

high 8.5 CVE-2026-42730 · published 2026-05-27

SQL injection in MasterStudy LMS WordPress Plugin (3.7.29 and older)

Affected: 3.7.29 and older
Fixed in: 3.7.30
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through <= 3.7.29.

NVD CVE-2026-42730 Patchstack advisory

Show 23 older records

medium 6.5 CVE-2026-4817 · published 2026-04-17

SQL injection in MasterStudy LMS WordPress Plugin (3.7.25 and older)

Affected: 3.7.25 and older
Fixed in: 3.7.26 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to Time-based Blind SQL Injection via the 'order' and 'orderby' parameters in the /lms/stm-lms/order/items REST API endpoint in versions up to and including 3.7.25. This is due to insufficient input sanitization combined with a design flaw in the custom Query builder class that allows unquoted SQL injection in ORDER BY clauses. When the Query builder detects parentheses in the sort_by parameter, it treats the value as a SQL function and directly concatenates it into the ORDER BY clause without any quoting. While esc_sql() is applied to escape quotes and backslashes, this cannot prevent ORDER BY injection when the values themselves are not wrapped in quotes in the resulting SQL statement. This makes it possible for authenticated attackers, with subscriber-level access and above, to append arbitrary SQL queries via the ORDER BY clause to extract sensitive information from the database including user credentials, session tokens, and other confidential data through time-based blind SQL injection techniques.

NVD CVE-2026-4817 Wordfence advisory Code change (fix)ti.wordfence.io Plugin source

medium 6.4 CVE-2026-0559 · published 2026-02-14

Stored cross-site scripting (XSS) in MasterStudy LMS WordPress Plugin (3.7.11 and older)

Affected: 3.7.11 and older
Fixed in: 3.7.12 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_lms_courses_grid_display' shortcode in all versions up to, and including, 3.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2026-0559 Wordfence advisory Code change (fix)

medium 5.4 CVE-2025-13766 · published 2026-01-06

Missing authorization check in MasterStudy LMS WordPress Plugin (3.7.6 and older)

Affected: 3.7.6 and older
Fixed in: 3.7.7 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability checks on multiple REST API endpoints in all versions up to, and including, 3.7.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload or delete arbitrary media files, delete or modify posts, and create/manage course templates

NVD CVE-2025-13766 Wordfence advisory Code change (fix)

high 7.6 CVE-2025-64366 · published 2025-10-31

SQL injection in MasterStudy LMS WordPress Plugin (3.6.27 and older)

Affected: 3.6.27 and older
Fixed in: 3.6.28
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

NVD CVE-2025-64366 Patchstack advisory

medium 4.9 CVE-2025-59575 · published 2025-10-22

Information disclosure in MasterStudy LMS WordPress Plugin (3.6.20 and older)

Affected: 3.6.20 and older
Fixed in: 3.6.21
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.

NVD CVE-2025-59575 Patchstack advisory

medium 4.3 CVE-2025-59577 · published 2025-09-22

Security issue in MasterStudy LMS WordPress Plugin (3.6.20 and older)

Affected: 3.6.20 and older
Fixed in: 3.6.21
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Leveraging Race Conditions.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.

NVD CVE-2025-59577 Patchstack advisory

medium 6.5 CVE-2025-59576 · published 2025-09-22

Missing authorization check in MasterStudy LMS WordPress Plugin (3.6.20 and older)

Affected: 3.6.20 and older
Fixed in: 3.6.21
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.

NVD CVE-2025-59576 Patchstack advisory

medium 6.5 CVE-2025-54744 · published 2025-09-05

Missing authorization check in MasterStudy LMS WordPress Plugin (3.6.15 and older)

Affected: 3.6.15 and older
Fixed in: 3.6.16
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

NVD CVE-2025-54744 Patchstack advisory

medium 4.3 CVE-2025-32237 · published 2025-04-04

Missing authorization check in MasterStudy LMS WordPress Plugin (3.5.28 and older)

Affected: 3.5.28 and older
Fixed in: 3.5.29
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

NVD CVE-2025-32237 Patchstack advisory

high 8.8 CVE-2025-32141 · published 2025-04-04

File inclusion in MasterStudy LMS WordPress Plugin (3.5.28 and older)

Affected: 3.5.28 and older
Fixed in: 3.5.29
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows PHP Local File Inclusion.This issue affects MasterStudy LMS: from n/a through <= 3.5.28.

NVD CVE-2025-32141 Patchstack advisory

high 8.8 CVE-2024-37093 · published 2025-01-02

Cross-site request forgery (CSRF) in MasterStudy LMS WordPress Plugin (3.2.1 and older)

Affected: 3.2.1 and older
Fixed in: 3.2.2
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Cross-Site Request Forgery (CSRF) vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Cross Site Request Forgery.This issue affects MasterStudy LMS: from n/a through <= 3.2.1.

NVD CVE-2024-37093 Patchstack advisory

critical 9.8 CVE-2024-37094 · published 2024-11-01

Missing authorization check in MasterStudy LMS WordPress Plugin (3.2.12 and older)

Affected: 3.2.12 and older
Fixed in: 3.2.13
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MasterStudy LMS: from n/a through 3.2.12.

NVD CVE-2024-37094 Patchstack advisory

high 8.8 CVE-2024-5973 · published 2024-07-22

Security issue in MasterStudy LMS WordPress Plugin (older than 3.3.24)

Affected: older than 3.3.24
Fixed in: 3.3.24
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which could be used to get access to functionalities they shouldn't have.

NVD CVE-2024-5973 WPScan advisory

medium 5.4 CVE-2024-3942 · published 2024-05-02

Missing authorization check in MasterStudy LMS WordPress Plugin (3.3.8 and older)

Affected: 3.3.8 and older
Fixed in: 3.3.9 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on several functions in versions up to, and including, 3.3.8. This makes it possible for authenticated attackers, with subscriber level permissions and above, to read and modify content such as course questions, post titles, and taxonomies.

NVD CVE-2024-3942 Wordfence advisory Code change (fix)

critical 9.8 CVE-2024-3136 · published 2024-04-09

File inclusion in MasterStudy LMS WordPress Plugin (3.3.3 and older)

Affected: 3.3.3 and older
Fixed in: 3.3.4 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

NVD CVE-2024-3136 Wordfence advisory Code change (fix)

medium 4.3 CVE-2024-1904 · published 2024-04-09

Missing authorization check in MasterStudy LMS WordPress Plugin (3.2.13 and older)

Affected: 3.2.13 and older
Fixed in: 3.3.0 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the search_posts function in all versions up to, and including, 3.2.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose draft post titles and excerpts.

NVD CVE-2024-1904 Wordfence advisory Code change (fix)

critical 9.8 CVE-2024-2409 · published 2024-03-29

Privilege escalation in MasterStudy LMS WordPress Plugin (3.3.1 and older)

Affected: 3.3.1 and older
Fixed in: 3.3.2 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the _register_user() function called by the 'wp_ajax_nopriv_stm_lms_register' AJAX action. This makes it possible for unauthenticated attackers to register a user with administrator-level privileges when MasterStudy LMS Pro is installed and the LMS Forms Editor add-on is enabled.

NVD CVE-2024-2409 Wordfence advisory Code change (fix)docs.stylemixthemes.com

critical 9.8 CVE-2024-2411 · published 2024-03-29

File inclusion in MasterStudy LMS WordPress Plugin (3.3.0 and older)

Affected: 3.3.0 and older
Fixed in: 3.3.1 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

NVD CVE-2024-2411 Wordfence advisory Code change (fix)docs.stylemixthemes.com

high 7.5 CVE-2024-2106 · published 2024-03-13

Information disclosure in MasterStudy LMS WordPress Plugin (3.2.10 and older)

Affected: 3.2.10 and older
Fixed in: 3.2.11 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 3.2.10. This can allow unauthenticated attackers to extract sensitive data including all registered user's username and email addresses which can be used to help perform future attacks.

NVD CVE-2024-2106 Wordfence advisory Code change (fix)plugins.svn.wordpress.org plugins.svn.wordpress.org

critical 9.8 CVE-2024-1512 · published 2024-02-17

SQL injection in MasterStudy LMS WordPress Plugin (3.2.5 and older)

Affected: 3.2.5 and older
Fixed in: 3.2.6 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

NVD CVE-2024-1512 Wordfence advisory Code change (fix)

high 7.5 CVE-2023-4278 · published 2023-09-11

Security issue in MasterStudy LMS WordPress Plugin (older than 3.0.18)

Affected: older than 3.0.18
Fixed in: 3.0.18
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.

NVD CVE-2023-4278 WPScan advisory packetstormsecurity.com

medium 6.5 CVE-2023-35093 · published 2023-06-22

Missing authorization check in MasterStudy LMS WordPress Plugin (3.0.8 and older)

Affected: 3.0.8 and older
Fixed in: 3.0.9 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any logged-in users, such as subscribers to view the "Orders" of the plugin and get the data related to the order like email, username, and more.

NVD CVE-2023-35093 Patchstack advisory

medium 5.4 CVE-2023-35090 · published 2023-06-22

Stored cross-site scripting (XSS) in MasterStudy LMS WordPress Plugin (3.0.7 and older)

Affected: 3.0.7 and older
Fixed in: 3.0.8 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.7 versions.

NVD CVE-2023-35090 Patchstack advisory

Recent activity

2026-11-02 — latest release on wordpress.org (3.7.58).
2026-10-30 — PHP object injection disclosed (CVE-2026-118090), fixed in 3.7.56.
2026-10-29 — Missing authorization check disclosed (CVE-2026-118092), fixed in 3.7.56.
2026-10-22 — Missing authorization check disclosed (CVE-2026-88849), fixed in 3.7.55.

Free. We check the CVE feeds every day and email you only when a new issue for MasterStudy LMS WordPress Plugin (masterstudy-lms-learning-management-system) is published or a fix ships. Unsubscribe in one click.

Browse vulnerabilities

Types found in this plugin: Missing authorization (24) · Sensitive data exposure (5) · SQL injection (5) · Cross-site scripting (XSS) (4) · File inclusion (3) · Privilege escalation (2) · PHP object injection (1) · Path traversal and file read (1) · Content injection (1) · Open redirect (1) · Arbitrary file deletion (1) · Cross-site request forgery (CSRF) (1)

Where this data comes from

Version, last update, installs: wordpress.org/plugins/masterstudy-lms-learning-management-system (Plugins API), fetched 2026-11-04.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/masterstudy-lms-learning-management-system"><img src="https://laskyr.com/plugins/masterstudy-lms-learning-management-system/badge.svg" alt="MasterStudy LMS WordPress Plugin vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is MasterStudy LMS WordPress Plugin safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (3.7.58)

What to do

Check your version

Known vulnerabilities

PHP object injection in MasterStudy LMS WordPress Plugin (3.7.55 and older)

Missing authorization check in MasterStudy LMS WordPress Plugin (3.7.55 and older)

Missing authorization check in MasterStudy LMS WordPress Plugin (3.7.13 up to (not including) 3.7.55)

Stored cross-site scripting (XSS) in MasterStudy LMS WordPress Plugin (3.7.52 and older)

Path traversal / file read in MasterStudy LMS WordPress Plugin (3.5.29 up to (not including) 3.7.50)

Missing authorization check in MasterStudy LMS WordPress Plugin (2.3.0 up to (not including) 3.7.50)

Missing authorization check in MasterStudy LMS WordPress Plugin (2.3.0 up to (not including) 3.7.50)

Missing authorization check in MasterStudy LMS WordPress Plugin (older than 3.7.50)

Content injection in MasterStudy LMS WordPress Plugin (older than 3.7.50)

Missing authorization check in MasterStudy LMS WordPress Plugin (older than 3.7.50)

Missing authorization check in MasterStudy LMS WordPress Plugin (3.6.2 up to (not including) 3.7.50)

Missing authorization check in MasterStudy LMS WordPress Plugin (older than 3.7.50)

Information disclosure in MasterStudy LMS WordPress Plugin (older than 3.7.46)

Missing authorization check in MasterStudy LMS WordPress Plugin (older than 3.7.46)

Information disclosure in MasterStudy LMS WordPress Plugin (older than 3.7.46)

Missing authorization check in MasterStudy LMS WordPress Plugin (older than 3.7.46)

Information disclosure in MasterStudy LMS WordPress Plugin (older than 3.7.46)

Missing authorization check in MasterStudy LMS WordPress Plugin (older than 3.7.46)

Missing authorization check in MasterStudy LMS WordPress Plugin (older than 3.7.42)

Open redirect in MasterStudy LMS WordPress Plugin (older than 3.7.43)

Missing authorization check in MasterStudy LMS WordPress Plugin (older than 3.7.40)

Arbitrary file deletion in MasterStudy LMS WordPress Plugin (3.7.42 and older)

Missing authorization check in MasterStudy LMS WordPress Plugin (3.7.41 and older)

Privilege escalation in MasterStudy LMS WordPress Plugin (3.7.41 and older)

Security issue in MasterStudy LMS WordPress Plugin (3.7.39 and older)

Missing authorization check in MasterStudy LMS WordPress Plugin (3.7.23 and older)

Cross-site scripting (XSS) in MasterStudy LMS WordPress Plugin (3.7.27 and older)

Missing authorization check in MasterStudy LMS WordPress Plugin (3.7.30 and older)

SQL injection in MasterStudy LMS WordPress Plugin (3.7.25 and older)

SQL injection in MasterStudy LMS WordPress Plugin (3.7.29 and older)

SQL injection in MasterStudy LMS WordPress Plugin (3.7.25 and older)

Stored cross-site scripting (XSS) in MasterStudy LMS WordPress Plugin (3.7.11 and older)

Missing authorization check in MasterStudy LMS WordPress Plugin (3.7.6 and older)

SQL injection in MasterStudy LMS WordPress Plugin (3.6.27 and older)

Information disclosure in MasterStudy LMS WordPress Plugin (3.6.20 and older)

Security issue in MasterStudy LMS WordPress Plugin (3.6.20 and older)

Missing authorization check in MasterStudy LMS WordPress Plugin (3.6.20 and older)

Missing authorization check in MasterStudy LMS WordPress Plugin (3.6.15 and older)

Missing authorization check in MasterStudy LMS WordPress Plugin (3.5.28 and older)

File inclusion in MasterStudy LMS WordPress Plugin (3.5.28 and older)

Cross-site request forgery (CSRF) in MasterStudy LMS WordPress Plugin (3.2.1 and older)

Missing authorization check in MasterStudy LMS WordPress Plugin (3.2.12 and older)

Security issue in MasterStudy LMS WordPress Plugin (older than 3.3.24)

Missing authorization check in MasterStudy LMS WordPress Plugin (3.3.8 and older)

File inclusion in MasterStudy LMS WordPress Plugin (3.3.3 and older)

Missing authorization check in MasterStudy LMS WordPress Plugin (3.2.13 and older)

Privilege escalation in MasterStudy LMS WordPress Plugin (3.3.1 and older)

File inclusion in MasterStudy LMS WordPress Plugin (3.3.0 and older)

Information disclosure in MasterStudy LMS WordPress Plugin (3.2.10 and older)

SQL injection in MasterStudy LMS WordPress Plugin (3.2.5 and older)

Security issue in MasterStudy LMS WordPress Plugin (older than 3.0.18)

Missing authorization check in MasterStudy LMS WordPress Plugin (3.0.8 and older)

Stored cross-site scripting (XSS) in MasterStudy LMS WordPress Plugin (3.0.7 and older)

Recent activity

Get an email when MasterStudy LMS WordPress Plugin has a new vulnerability

Browse vulnerabilities

Where this data comes from