CVE-2026-73404: MasterStudy LMS Auth Bypass Vulnerability

CVE-2026-73404 Overview

CVE-2026-73404 is a broken access control vulnerability affecting the MasterStudy LMS Learning Management System plugin for WordPress in versions up to and including 3.7.41. The flaw allows an authenticated user with Subscriber-level privileges to access resources or perform actions that should be restricted to higher-privileged roles. The vulnerability is categorized under CWE-862: Missing Authorization and is exploitable over the network with low attack complexity. Successful exploitation results in confidentiality impact on data managed by the plugin.

Critical Impact
Authenticated Subscriber accounts can bypass access controls in MasterStudy LMS <= 3.7.41, leading to unauthorized disclosure of protected learning-management data.

Affected Products

MasterStudy LMS Learning Management System plugin for WordPress
Versions <= 3.7.41
WordPress sites running the vulnerable plugin with self-registration enabled

Discovery Timeline

2026-08-18 - CVE-2026-73404 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73404

Vulnerability Analysis

The vulnerability resides in the MasterStudy LMS plugin, a WordPress learning management extension that exposes numerous REST and AJAX endpoints for course, lesson, and user operations. One or more of these endpoints fail to enforce role-based authorization checks. As a result, users authenticated at the lowest WordPress privilege tier, Subscriber, can invoke functionality intended for instructors or administrators.

Because WordPress typically allows open user registration and MasterStudy LMS often provisions Subscriber-equivalent roles for enrolled students, the attacker prerequisite is trivial to satisfy. The attacker submits crafted requests to the affected endpoint and receives protected data in the response. The impact is limited to confidentiality: integrity and availability are not affected according to the published CVSS vector.

Root Cause

The root cause is missing authorization logic in one or more plugin request handlers. WordPress plugins are expected to validate the acting user through current_user_can() capability checks or equivalent role gating before returning privileged data. In the affected versions, this check is absent or improperly scoped, so any authenticated session, including Subscriber, satisfies the authentication requirement without a corresponding capability requirement.

Attack Vector

An attacker registers or obtains a Subscriber account on the target WordPress site. The attacker then issues an authenticated HTTP request to the vulnerable MasterStudy LMS endpoint. No user interaction from an administrator or instructor is required, and no elevated privileges are needed prior to the request. See the Patchstack Vulnerability Report for endpoint-level technical details.

Detection Methods for CVE-2026-73404

Indicators of Compromise

Unexpected HTTP requests from Subscriber accounts to MasterStudy LMS REST routes under /wp-json/ or AJAX handlers via admin-ajax.php.
Access logs showing low-privilege accounts retrieving instructor or course-management data.
Spikes in new Subscriber-role user registrations followed by API activity against LMS endpoints.

Detection Strategies

Review WordPress access logs for authenticated requests to MasterStudy LMS endpoints originating from users whose role is Subscriber.
Correlate wp_usermeta role assignments with recent API activity to surface low-privilege accounts touching privileged plugin routes.
Deploy a web application firewall rule that flags Subscriber-authenticated requests to MasterStudy LMS administrative endpoints.

Monitoring Recommendations

Enable verbose logging on WordPress and forward admin-ajax.php and REST traffic to a centralized SIEM for role-based analysis.
Alert on newly registered accounts that generate API traffic within minutes of account creation.
Track plugin version inventory across WordPress fleets to identify hosts still running MasterStudy LMS <= 3.7.41.

How to Mitigate CVE-2026-73404

Immediate Actions Required

Update the MasterStudy LMS Learning Management System plugin to a version later than 3.7.41 as soon as the vendor-supplied patch is applied.
Audit existing Subscriber accounts and remove any that were created without a legitimate business reason.
Temporarily disable open user registration in Settings > General if a patched version cannot be deployed immediately.

Patch Information

Refer to the Patchstack Vulnerability Report for the fixed version and vendor advisory details. Update the plugin through the WordPress admin dashboard under Plugins > Installed Plugins or via WP-CLI.

Workarounds

Restrict access to the MasterStudy LMS endpoints at the web server or WAF layer until the plugin is updated.
Disable the plugin entirely on sites that do not actively use its learning-management features.
Enforce strong registration controls, including CAPTCHA and email verification, to slow automated Subscriber account creation.

bash

# Update MasterStudy LMS via WP-CLI
wp plugin update masterstudy-lms-learning-management-system

# Verify installed version is greater than 3.7.41
wp plugin get masterstudy-lms-learning-management-system --field=version

# Temporarily disable open registration if patching is delayed
wp option update users_can_register 0