CVE-2026-88844 Overview
CVE-2026-88844 affects the MasterStudy LMS WordPress plugin in versions before 3.7.50. The plugin fails to verify that the requesting user owns a course before returning its enrolled-student data. Users assigned the Instructor role can query student records tied to courses owned by other instructors. The disclosed data includes student names and email addresses.
The flaw is classified as an Insecure Direct Object Reference [CWE-639]. Exploitation requires an authenticated account with Instructor privileges and can be performed remotely over the network. The issue impacts confidentiality of enrolled learner data across tenant boundaries within the same WordPress installation.
Critical Impact
Authenticated instructors can enumerate names and email addresses of students enrolled in courses owned by other instructors, exposing personally identifiable information (PII).
Affected Products
- MasterStudy LMS WordPress Plugin versions prior to 3.7.50
- WordPress installations that assign the plugin's Instructor role to multiple users
- Learning platforms using MasterStudy LMS for multi-instructor course delivery
Discovery Timeline
- 2026-09-18 - CVE-2026-88844 published to NVD
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-88844
Vulnerability Analysis
The MasterStudy LMS plugin exposes endpoints that return enrolled-student data for a given course. The server-side handler accepts a course identifier from the requesting user and returns the associated student roster without checking whether the requester is the course owner. Any account with the Instructor role can substitute another instructor's course identifier and receive that course's enrollment data.
The returned data includes student names and email addresses. This creates a horizontal privilege escalation path across instructor accounts and enables enumeration of PII belonging to learners the requesting instructor should not be able to view. The vulnerability does not affect integrity or availability of the plugin's data.
Root Cause
The root cause is missing object-level authorization on the course roster endpoint. The handler trusts the course ID supplied in the request and does not compare it against the ownership records for the authenticated user. This pattern maps directly to CWE-639: Authorization Bypass Through User-Controlled Key.
Attack Vector
An attacker authenticates to the WordPress site using an existing Instructor account. The attacker then issues a request to the plugin's enrolled-student data endpoint, supplying a course identifier owned by a different instructor. The server returns the student roster without validating ownership. Course identifiers are typically sequential numeric IDs and can be enumerated. See the WPScan Vulnerability Report for advisory details.
Detection Methods for CVE-2026-88844
Indicators of Compromise
- Repeated requests to MasterStudy LMS course-roster endpoints from a single instructor account referencing many distinct course IDs
- Sequential enumeration of course identifiers in access logs from authenticated Instructor sessions
- Unexpected outbound transfers of student PII correlated with instructor account activity
Detection Strategies
- Review WordPress access logs for authenticated requests to MasterStudy LMS student-enrollment endpoints and correlate the referenced course IDs against course ownership records
- Alert when a single Instructor account requests roster data for courses owned by other instructors within a short time window
- Baseline normal per-instructor request volume against student endpoints and flag deviations
Monitoring Recommendations
- Enable verbose logging on the WordPress REST and admin-ajax endpoints exposed by MasterStudy LMS
- Forward web server and application logs to a centralized analytics platform for cross-account correlation
- Track creation of new Instructor accounts and monitor their initial query patterns for enumeration behavior
How to Mitigate CVE-2026-88844
Immediate Actions Required
- Upgrade the MasterStudy LMS WordPress plugin to version 3.7.50 or later on all affected sites
- Audit existing Instructor accounts and remove roles that are no longer required
- Review recent access logs for cross-course roster queries and notify affected students if PII disclosure occurred
Patch Information
The vendor addressed the vulnerability in MasterStudy LMS version 3.7.50. The fix adds ownership verification before returning enrolled-student data. Refer to the WPScan Vulnerability Report for the advisory reference.
Workarounds
- Restrict the Instructor role to trusted users until the plugin is upgraded
- Place the WordPress admin and REST endpoints behind a Web Application Firewall (WAF) rule that limits per-user request rates to course-roster endpoints
- Disable the plugin on sites that cannot immediately apply the patch and where multi-instructor isolation is required
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
