CVE-2026-28145: MasterStudy LMS Auth Bypass Vulnerability

CVE-2026-28145 Overview

CVE-2026-28145 is an Insufficient Verification of Data Authenticity vulnerability [CWE-345] in the StylemixThemes MasterStudy LMS plugin for WordPress. The flaw enables unauthenticated attackers to manipulate user state through broken access control. The issue affects all MasterStudy LMS versions up to and including 3.7.39. The vulnerability is network-exploitable, requires no privileges, and needs no user interaction. Impact is limited to integrity, with no direct compromise of confidentiality or availability.

Critical Impact
Unauthenticated attackers can manipulate user state in MasterStudy LMS installations, allowing tampering with learner or account data on WordPress sites running versions up to 3.7.39.

Affected Products

StylemixThemes MasterStudy LMS plugin for WordPress
MasterStudy LMS versions from n/a through 3.7.39
WordPress sites using the MasterStudy Learning Management System

Discovery Timeline

2026-07-31 - CVE-2026-28145 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-28145

Vulnerability Analysis

CVE-2026-28145 arises from insufficient verification of data authenticity in the MasterStudy LMS plugin. The plugin accepts state-changing requests without properly validating the source or integrity of the submitted data. This gap in access control lets remote attackers manipulate user state on affected WordPress sites.

The vulnerability affects integrity but does not directly expose sensitive data or crash the application. Attackers can send crafted HTTP requests to plugin endpoints that alter user-related state without authenticating. Because MasterStudy LMS powers course delivery, quizzes, and enrollment flows, tampering with user state can affect course progress, permissions, or account attributes tied to learners.

Root Cause

The root cause is broken access control combined with insufficient verification of request authenticity, mapped to [CWE-345]. Plugin request handlers do not adequately confirm that incoming data originates from an authorized user or trusted source. Nonce checks, capability checks, or signature validation are missing or incomplete on the affected endpoints.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. An unauthenticated attacker sends crafted requests to the vulnerable MasterStudy LMS endpoints on a target WordPress site. No user interaction is required. The attacker manipulates parameters that control user state, causing the plugin to accept and persist unauthorized modifications. See the Patchstack Vulnerability Advisory for technical details on the vulnerable request handling.

Detection Methods for CVE-2026-28145

Indicators of Compromise

Unexpected changes to WordPress user meta, course progress, or enrollment records in MasterStudy LMS.
HTTP POST or GET requests to MasterStudy LMS AJAX or REST endpoints from unauthenticated sessions.
Sudden bulk modifications to learner state that do not correspond to legitimate admin activity.

Detection Strategies

Review web server access logs for anomalous requests targeting MasterStudy LMS plugin paths under /wp-content/plugins/masterstudy-lms-learning-management-system/ or associated admin-ajax.php and REST routes.
Audit WordPress database tables such as wp_usermeta and MasterStudy LMS course tables for unauthorized state changes.
Correlate plugin activity with authentication logs to identify state-changing calls without a corresponding authenticated session.

Monitoring Recommendations

Enable verbose WordPress logging and forward events to a centralized SIEM for correlation.
Monitor request rates and parameter patterns against MasterStudy LMS endpoints to detect enumeration or scripted abuse.
Alert on plugin version fingerprints matching 3.7.39 or earlier to prioritize remediation across managed sites.

How to Mitigate CVE-2026-28145

Immediate Actions Required

Update MasterStudy LMS to a fixed release above version 3.7.39 as soon as it is available from StylemixThemes.
Inventory all WordPress sites running MasterStudy LMS and confirm the installed plugin version.
Restrict administrative access to WordPress and enforce strong authentication for privileged accounts.

Patch Information

Refer to the Patchstack Vulnerability Advisory for the current patch status and vendor guidance. Apply the vendor-supplied update through the WordPress plugin manager once released. Verify the plugin version reports a release later than 3.7.39 after patching.

Workarounds

Deploy a Web Application Firewall (WAF) rule to block unauthenticated requests to MasterStudy LMS state-changing endpoints until patched.
Temporarily deactivate the MasterStudy LMS plugin on sites where the learning management functionality is not in active use.
Restrict access to WordPress admin and plugin endpoints by IP allowlist where operationally feasible.

bash

# Check installed MasterStudy LMS plugin version via WP-CLI
wp plugin get masterstudy-lms-learning-management-system --field=version

# Deactivate the plugin as a temporary mitigation
wp plugin deactivate masterstudy-lms-learning-management-system

# Update the plugin once a fixed version is released
wp plugin update masterstudy-lms-learning-management-system